diff options
| -rw-r--r-- | .github/workflows/ci.yml | 7 | ||||
| -rw-r--r-- | aes/CMakeLists.txt | 6 | ||||
| -rw-r--r-- | aes/src/asm64/aes128.asm | 205 | ||||
| -rw-r--r-- | aes/src/asm64/aes192.asm | 252 | ||||
| -rw-r--r-- | aes/src/asm64/aes256.asm | 290 |
5 files changed, 757 insertions, 3 deletions
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c8ccabc..1f9a2e2 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -37,12 +37,15 @@ jobs: configuration: [Debug, Release] include: - boost-version: 1.81.0 + - {toolset: gcc, os: ubuntu-latest} - {toolset: vs2022, os: windows-2022} # Boost only supports VS 2026 starting with version 1.91, I think? - {toolset: vs2026, os: windows-2025, boost-version: 1.91.0} + + - {platform: x86, cmake_var: AES_TOOLS_ASM} + - {platform: x64, cmake_var: AES_TOOLS_ASM64} exclude: - - {platform: x64, use_asm: 1} - {toolset: gcc, use_asm: 1} runs-on: '${{ matrix.os }}' name: | @@ -52,7 +55,7 @@ jobs: PLATFORM: '${{ matrix.platform }}' CONFIGURATION: '${{ matrix.configuration }}' BOOST_VERSION: '${{ matrix.boost-version }}' - CMAKE_FLAGS: '--cmake-arg=-DAES_TOOLS_ASM=${{ matrix.use_asm }}' + CMAKE_FLAGS: '--cmake-arg=-D${{ matrix.cmake_var }}=${{ matrix.use_asm }}' steps: - name: Checkout uses: actions/checkout@v7 diff --git a/aes/CMakeLists.txt b/aes/CMakeLists.txt index e48fe24..11d4d94 100644 --- a/aes/CMakeLists.txt +++ b/aes/CMakeLists.txt @@ -1,7 +1,8 @@ set(CMAKE_C_STANDARD 11) set(CMAKE_C_STANDARD_REQUIRED ON) -option(AES_TOOLS_ASM "Use the assembly language implementation instead of the one in C") +option(AES_TOOLS_ASM "Use the 32-bit ASM implementation") +option(AES_TOOLS_ASM64 "Use the 64-bit ASM implementation") file(GLOB_RECURSE aes_include CONFIGURE_DEPENDS "include/*.h") file(GLOB aes_src CONFIGURE_DEPENDS "src/*.c") @@ -11,6 +12,9 @@ if(MSVC AND AES_TOOLS_ASM) file(GLOB aes_src_impl CONFIGURE_DEPENDS "src/asm/*.asm") set_source_files_properties(${aes_src_impl} PROPERTIES COMPILE_FLAGS /safeseh) # Setting CMAKE_ASM_MASM_FLAGS doesn't work: http://www.cmake.org/Bug/view.php?id=14711 +elseif(MSVC AND AES_TOOLS_ASM64) + enable_language(ASM_MASM) + file(GLOB aes_src_impl CONFIGURE_DEPENDS "src/asm64/*.asm") else() file(GLOB aes_src_impl CONFIGURE_DEPENDS "src/c/*.c") endif() diff --git a/aes/src/asm64/aes128.asm b/aes/src/asm64/aes128.asm new file mode 100644 index 0000000..c1349f4 --- /dev/null +++ b/aes/src/asm64/aes128.asm @@ -0,0 +1,205 @@ +; Copyright (c) 2026 Egor Tensin <egor@tensin.name> +; This file is part of the "AES tools" project. +; For details, see https://github.com/egor-tensin/aes-tools. +; Distributed under the MIT License. + +; Copied from asm/aes128.asm + +.code + +aes128_encrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesenc xmm0, [rdx + 10h] + aesenc xmm0, [rdx + 20h] + aesenc xmm0, [rdx + 30h] + aesenc xmm0, [rdx + 40h] + aesenc xmm0, [rdx + 50h] + aesenc xmm0, [rdx + 60h] + aesenc xmm0, [rdx + 70h] + aesenc xmm0, [rdx + 80h] + aesenc xmm0, [rdx + 90h] + aesenclast xmm0, [rdx + 0A0h] + ret +aes128_encrypt_block_internal endp + +aes128_decrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesdec xmm0, [rdx + 10h] + aesdec xmm0, [rdx + 20h] + aesdec xmm0, [rdx + 30h] + aesdec xmm0, [rdx + 40h] + aesdec xmm0, [rdx + 50h] + aesdec xmm0, [rdx + 60h] + aesdec xmm0, [rdx + 70h] + aesdec xmm0, [rdx + 80h] + aesdec xmm0, [rdx + 90h] + aesdeclast xmm0, [rdx + 0A0h] + ret +aes128_decrypt_block_internal endp + +aes128_expand_key_internal proc + ; A "word" (in terms of the FIPS 187 standard) is a 32-bit block. + ; Words are denoted by `w[N]`. + ; + ; A key schedule is composed of 10 "regular" keys and a dumb key for + ; the "whitening" step. + ; + ; A key schedule is thus composed of 44 "words". + ; The FIPS standard includes an algorithm to calculate these words via + ; a simple loop: + ; + ; i = 4 + ; while i < 44: + ; temp = w[i - 1] + ; if i % 4 == 0: + ; temp = SubWord(RotWord(temp))^Rcon + ; w[i] = w[i - 4]^temp + ; i = i + 1 + ; + ; The loop above may be unrolled like this: + ; + ; w[4] = SubWord(RotWord(w[3]))^Rcon^w[0] + ; w[5] = w[4]^w[1] + ; = SubWord(RotWord(w[3]))^Rcon^w[1]^w[0] + ; w[6] = w[5]^w[2] + ; = SubWord(RotWord(w[3]))^Rcon^w[2]^w[1]^w[0] + ; w[7] = w[6]^w[3] + ; = SubWord(RotWord(w[3]))^Rcon^w[3]^w[2]^w[1]^w[0] + ; w[8] = SubWord(RotWord(w[7]))^Rcon^w[4] + ; w[9] = w[8]^w[5] + ; = SubWord(RotWord(w[7]))^Rcon^w[5]^w[4] + ; w[10] = w[9]^w[6] + ; = SubWord(RotWord(w[7]))^Rcon^w[6]^w[5]^w[4] + ; w[11] = w[10]^w[7] + ; = SubWord(RotWord(w[7]))^Rcon^w[7]^w[6]^w[5]^w[4] + ; + ; ... and so on. + ; + ; The Intel AES-NI instruction set facilitates calculating SubWord + ; and RotWord using `aeskeygenassist`, which is used in this routine. + ; + ; Preconditions: + ; * xmm0[127:96] == w[3], + ; * xmm0[95:64] == w[2], + ; * xmm0[63:32] == w[1], + ; * xmm0[31:0] == w[0]. + + movdqa xmm0, [rcx] + + movdqa [rdx], xmm0 ; sets w[0], w[1], w[2], w[3] + add rdx, 10h ; rdx = &w[4] + + aeskeygenassist xmm5, xmm0, 01h ; xmm5[127:96] = RotWord(SubWord(w[3]))^Rcon + call aes128_keygen_assist ; sets w[4], w[5], w[6], w[7] + aeskeygenassist xmm5, xmm0, 02h ; xmm5[127:96] = RotWord(SubWord(w[7]))^Rcon + call aes128_keygen_assist ; sets w[8], w[9], w[10], w[11] + aeskeygenassist xmm5, xmm0, 04h ; xmm5[127:96] = RotWord(SubWord(w[11]))^Rcon + call aes128_keygen_assist ; sets w[12], w[13], w[14], w[15] + aeskeygenassist xmm5, xmm0, 08h ; xmm5[127:96] = RotWord(SubWord(w[15]))^Rcon + call aes128_keygen_assist ; sets w[16], w[17], w[18], w[19] + aeskeygenassist xmm5, xmm0, 10h ; xmm5[127:96] = RotWord(SubWord(w[19]))^Rcon + call aes128_keygen_assist ; sets w[20], w[21], w[22], w[23] + aeskeygenassist xmm5, xmm0, 20h ; xmm5[127:96] = RotWord(SubWord(w[23]))^Rcon + call aes128_keygen_assist ; sets w[24], w[25], w[26], w[27] + aeskeygenassist xmm5, xmm0, 40h ; xmm5[127:96] = RotWord(SubWord(w[27]))^Rcon + call aes128_keygen_assist ; sets w[28], w[29], w[30], w[31] + aeskeygenassist xmm5, xmm0, 80h ; xmm5[127:96] = RotWord(SubWord(w[31]))^Rcon + call aes128_keygen_assist ; sets w[32], w[33], w[34], w[35] + aeskeygenassist xmm5, xmm0, 1Bh ; xmm5[127:96] = RotWord(SubWord(w[35]))^Rcon + call aes128_keygen_assist ; sets w[36], w[37], w[38], w[39] + aeskeygenassist xmm5, xmm0, 36h ; xmm5[127:96] = RotWord(SubWord(w[39]))^Rcon + call aes128_keygen_assist ; sets w[40], w[41], w[42], w[43] + + ret + +aes128_keygen_assist: + ; Preconditions: + ; * xmm0[127:96] == w[i+3], + ; * xmm0[95:64] == w[i+2], + ; * xmm0[63:32] == w[i+1], + ; * xmm0[31:0] == w[i], + ; * xmm5[127:96] == RotWord(SubWord(w[i+3]))^Rcon, + ; * rdx == &w[i+4]. + ; + ; Postconditions: + ; * xmm0[127:96] == w[i+7] == RotWord(SubWord(w[i+3]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i], + ; * xmm0[95:64] == w[i+6] == RotWord(SubWord(w[i+3]))^Rcon^w[i+2]^w[i+1]^w[i], + ; * xmm0[63:32] == w[i+5] == RotWord(SubWord(w[i+3]))^Rcon^w[i+1]^w[i], + ; * xmm0[31:0] == w[i+4] == RotWord(SubWord(w[i+3]))^Rcon^w[i], + ; * rdx == &w[i+8], + ; * the value in xmm4 is also modified. + + ; Calculate + ; w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+2]^w[i+1]^w[i], + ; w[i+1]^w[i] and + ; w[i]. + movdqa xmm4, xmm0 ; xmm4 = xmm0 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + ; xmm0[127:96] == w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+1]^w[i] + ; xmm0[31:0] == w[i] + + ; Calculate + ; w[i+7] == RotWord(SubWord(w[i+3]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+6] == RotWord(SubWord(w[i+3]))^Rcon^w[i+2]^w[i+1]^w[i], + ; w[i+5] == RotWord(SubWord(w[i+3]))^Rcon^w[i+1]^w[i] and + ; w[i+4] == RotWord(SubWord(w[i+3]))^Rcon^w[i]. + pshufd xmm4, xmm5, 0FFh ; xmm4[127:96] = xmm4[95:64] = xmm4[63:32] = xmm4[31:0] = xmm5[127:96] + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + ; xmm0[127:96] == w[i+7] == RotWord(SubWord(w[i+3]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+6] == RotWord(SubWord(w[i+3]))^Rcon^w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+5] == RotWord(SubWord(w[i+3]))^Rcon^w[i+1]^w[i] + ; xmm0[31:0] == w[i+4] == RotWord(SubWord(w[i+3]))^Rcon^w[i] + + ; Set w[i+4], w[i+5], w[i+6] and w[i+7]. + movdqa [rdx], xmm0 ; w[i+7] = RotWord(SubWord(w[i+3]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i] + ; w[i+6] = RotWord(SubWord(w[i+3]))^Rcon^w[i+2]^w[i+1]^w[i] + ; w[i+5] = RotWord(SubWord(w[i+3]))^Rcon^w[i+1]^w[i] + ; w[i+4] = RotWord(SubWord(w[i+3]))^Rcon^w[i] + add rdx, 10h ; rdx = &w[i+8] + + ret +aes128_expand_key_internal endp + +aes128_derive_decryption_keys_internal proc + movdqa xmm5, [rcx] + movdqa xmm4, [rcx + 0A0h] + movdqa [rdx], xmm4 + movdqa [rdx + 0A0h], xmm5 + + aesimc xmm5, [rcx + 10h] + aesimc xmm4, [rcx + 90h] + movdqa [rdx + 10h], xmm4 + movdqa [rdx + 90h], xmm5 + + aesimc xmm5, [rcx + 20h] + aesimc xmm4, [rcx + 80h] + movdqa [rdx + 20h], xmm4 + movdqa [rdx + 80h], xmm5 + + aesimc xmm5, [rcx + 30h] + aesimc xmm4, [rcx + 70h] + movdqa [rdx + 30h], xmm4 + movdqa [rdx + 70h], xmm5 + + aesimc xmm5, [rcx + 40h] + aesimc xmm4, [rcx + 60h] + movdqa [rdx + 40h], xmm4 + movdqa [rdx + 60h], xmm5 + + aesimc xmm5, [rcx + 50h] + movdqa [rdx + 50h], xmm5 + + ret +aes128_derive_decryption_keys_internal endp + +end diff --git a/aes/src/asm64/aes192.asm b/aes/src/asm64/aes192.asm new file mode 100644 index 0000000..2ffb28b --- /dev/null +++ b/aes/src/asm64/aes192.asm @@ -0,0 +1,252 @@ +; Copyright (c) 2026 Egor Tensin <egor@tensin.name> +; This file is part of the "AES tools" project. +; For details, see https://github.com/egor-tensin/aes-tools. +; Distributed under the MIT License. + +; Copied from asm/aes192.asm + +.code + +aes192_encrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesenc xmm0, [rdx + 10h] + aesenc xmm0, [rdx + 20h] + aesenc xmm0, [rdx + 30h] + aesenc xmm0, [rdx + 40h] + aesenc xmm0, [rdx + 50h] + aesenc xmm0, [rdx + 60h] + aesenc xmm0, [rdx + 70h] + aesenc xmm0, [rdx + 80h] + aesenc xmm0, [rdx + 90h] + aesenc xmm0, [rdx + 0A0h] + aesenc xmm0, [rdx + 0B0h] + aesenclast xmm0, [rdx + 0C0h] + ret +aes192_encrypt_block_internal endp + +aes192_decrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesdec xmm0, [rdx + 10h] + aesdec xmm0, [rdx + 20h] + aesdec xmm0, [rdx + 30h] + aesdec xmm0, [rdx + 40h] + aesdec xmm0, [rdx + 50h] + aesdec xmm0, [rdx + 60h] + aesdec xmm0, [rdx + 70h] + aesdec xmm0, [rdx + 80h] + aesdec xmm0, [rdx + 90h] + aesdec xmm0, [rdx + 0A0h] + aesdec xmm0, [rdx + 0B0h] + aesdeclast xmm0, [rdx + 0C0h] + ret +aes192_decrypt_block_internal endp + +aes192_expand_key_internal proc + ; A "word" (in terms of the FIPS 187 standard) is a 32-bit block. + ; Words are denoted by `w[N]`. + ; + ; A key schedule is composed of 12 "regular" keys and a dumb key for + ; the "whitening" step. + ; + ; A key schedule is thus composed of 52 "words". + ; The FIPS standard includes an algorithm to calculate these words via + ; a simple loop: + ; + ; i = 6 + ; while i < 52: + ; temp = w[i - 1] + ; if i % 6 == 0: + ; temp = SubWord(RotWord(temp))^Rcon + ; w[i] = w[i - 6]^temp + ; i = i + 1 + ; + ; The loop above may be unrolled like this: + ; + ; w[6] = SubWord(RotWord(w[5]))^Rcon^w[0] + ; w[7] = w[6]^w[1] + ; = SubWord(RotWord(w[5]))^Rcon^w[0]^w[1] + ; w[8] = w[7]^w[2] + ; = SubWord(RotWord(w[5]))^Rcon^w[0]^w[1]^w[2] + ; w[9] = w[8]^w[3] + ; = SubWord(RotWord(w[5]))^Rcon^w[0]^w[1]^w[2]^w[3] + ; w[10] = w[9]^w[4] + ; = SubWord(RotWord(w[5]))^Rcon^w[0]^w[1]^w[2]^w[3]^w[4] + ; w[11] = w[10]^w[5] + ; = SubWord(RotWord(w[5]))^Rcon^w[0]^w[1]^w[2]^w[3]^w[4]^w[5] + ; w[12] = SubWord(RotWord(w[11]))^Rcon^w[6] + ; w[13] = w[12]^w[7] + ; = SubWord(RotWord(w[11]))^Rcon^w[6]^w[7] + ; w[14] = w[13]^w[8] + ; = SubWord(RotWord(w[11]))^Rcon^w[6]^w[7]^w[8] + ; w[15] = w[14]^w[9] + ; = SubWord(RotWord(w[11]))^Rcon^w[6]^w[7]^w[8]^w[9] + ; w[16] = w[15]^w[10] + ; = SubWord(RotWord(w[11]))^Rcon^w[6]^w[7]^w[8]^w[9]^w[10] + ; w[17] = w[16]^w[11] + ; = SubWort(RotWord(w[11]))^Rcon^w[6]^w[7]^w[8]^w[9]^w[10]^w[11] + ; + ; ... and so on. + ; + ; The Intel AES-NI instruction set facilitates calculating SubWord + ; and RotWord using `aeskeygenassist`, which is used in this routine. + ; + ; Preconditions: + ; * xmm1[63:32] == w[5], + ; * xmm1[31:0] == w[4], + ; * xmm0[127:96] == w[3], + ; * xmm0[95:64] == w[2], + ; * xmm0[63:32] == w[1], + ; * xmm0[31:0] == w[0]. + + movdqa xmm0, [rcx] + movdqa xmm1, [rdx] + + movdqa [r8], xmm0 ; sets w[0], w[1], w[2], w[3] + movq qword ptr [r8 + 10h], xmm1 ; sets w[4], w[5] + + aeskeygenassist xmm5, xmm1, 1 ; xmm5[63:32] = RotWord(SubWord(w[5]))^Rcon, + call aes192_keygen_assist + movdqu [r8 + 18h], xmm0 + movq qword ptr [r8 + 28h], xmm1 + aeskeygenassist xmm5, xmm1, 2 ; xmm5[63:32] = RotWord(SubWord(w[11]))^Rcon + call aes192_keygen_assist + movdqa [r8 + 30h], xmm0 + movq qword ptr [r8 + 40h], xmm1 + aeskeygenassist xmm5, xmm1, 4 ; xmm5[63:32] = RotWord(SubWord(w[17]))^Rcon + call aes192_keygen_assist + movdqu [r8 + 48h], xmm0 + movq qword ptr [r8 + 58h], xmm1 + aeskeygenassist xmm5, xmm1, 8 ; xmm5[63:32] = RotWord(SubWord(w[23]))^Rcon + call aes192_keygen_assist + movdqa [r8 + 60h], xmm0 + movq qword ptr [r8 + 70h], xmm1 + aeskeygenassist xmm5, xmm1, 10h ; xmm5[63:32] = RotWord(SubWord(w[29]))^Rcon + call aes192_keygen_assist + movdqu [r8 + 78h], xmm0 + movq qword ptr [r8 + 88h], xmm1 + aeskeygenassist xmm5, xmm1, 20h ; xmm5[63:32] = RotWord(SubWord(w[35]))^Rcon + call aes192_keygen_assist + movdqa [r8 + 90h], xmm0 + movq qword ptr [r8 + 0a0h], xmm1 + aeskeygenassist xmm5, xmm1, 40h ; xmm5[63:32] = RotWord(SubWord(w[41]))^Rcon + call aes192_keygen_assist + movdqu [r8 + 0a8h], xmm0 + movq qword ptr [r8 + 0b8h], xmm1 + aeskeygenassist xmm5, xmm1, 80h ; xmm5[63:32] = RotWord(SubWord(w[49]))^Rcon + call aes192_keygen_assist + movdqa [r8 + 0c0h], xmm0 + + ret + +aes192_keygen_assist: + ; Preconditions: + ; * xmm1[127:96] == 0, + ; * xmm1[95:64] == 0, + ; * xmm1[63:32] == w[i+5], + ; * xmm1[31:0] == w[i+4], + ; * xmm0[127:96] == w[i+3], + ; * xmm0[95:64] == w[i+2], + ; * xmm0[63:32] == w[i+1], + ; * xmm0[31:0] == w[i], + ; * xmm5[63:32] == RotWord(SubWord(w[i+5]))^Rcon. + ; + ; Postconditions: + ; * xmm1[127:96] == 0, + ; * xmm1[95:64] == 0, + ; * xmm1[63:32] == w[i+11] == RotWord(SubWord(w[i+5]))^Rcon^w[i+5]^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i], + ; * xmm1[31:0] == w[i+10] == RotWord(SubWord(w[i+5]))^Rcon^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i], + ; * xmm0[127:96] == w[i+9] == RotWord(SubWord(w[i+5]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i], + ; * xmm0[95:64] == w[i+8] == RotWord(SubWord(w[i+5]))^Rcon^w[i+2]^w[i+1]^w[i], + ; * xmm0[63:32] == w[i+7] == RotWord(SubWord(w[i+5]))^Rcon^w[i+1]^w[i], + ; * xmm0[31:0] == w[i+6] == RotWord(SubWord(w[i+5]))^Rcon^w[i], + ; * the value in xmm4 is also modified. + + ; Calculate + ; w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+2]^w[i+1]^w[i], + ; w[i+1]^w[i] and + ; w[i]. + movdqa xmm4, xmm0 ; xmm4 = xmm0 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + ; xmm0[127:96] == w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+1]^w[i] + ; xmm0[31:0] == w[i] + + ; Calculate + ; w[i+9] == RotWord(SubWord(w[i+5]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+8] == RotWord(SubWord(w[i+5]))^Rcon^w[i+2]^w[i+1]^w[i], + ; w[i+7] == RotWord(SubWord(w[i+5]))^Rcon^w[i+1]^w[i] and + ; w[i+6] == RotWord(SubWord(w[i+5]))^Rcon^w[i]. + pshufd xmm4, xmm5, 55h ; xmm4[127:96] = xmm4[95:64] = xmm4[63:32] = xmm4[31:0] = xmm5[63:32] + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + ; xmm0[127:96] == w[i+9] == RotWord(SubWord(w[i+5]))^Rcon^w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+8] == RotWord(SubWord(w[i+5]))^Rcon^w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+7] == RotWord(SubWord(w[i+5]))^Rcon^w[i+1]^w[i] + ; xmm0[31:0] == w[i+6] == RotWord(SubWord(w[i+5]))^Rcon^w[i] + + ; Calculate + ; w[i+5]^w[i+4], + ; w[i+4]. + pshufd xmm4, xmm1, 0F3h ; xmm4 = xmm1[31:0] << 32 + pxor xmm1, xmm4 ; xmm1 ^= xmm5 + ; xmm1[63:32] == w[i+5]^w[i+4] + ; xmm1[31:0] == w[i+4] + + ; Calculate + ; w[i+10] == RotWord(SubWord(w[i+5]))^Rcon^w[i+5]^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+11] == RotWord(SubWord(w[i+5]))^Rcon^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i]. + pshufd xmm4, xmm0, 0FFh ; xmm4[127:96] = xmm4[95:64] = xmm4[63:32] = xmm4[31:0] = xmm0[127:96] + psrldq xmm4, 8 ; xmm4 >>= 64 + pxor xmm1, xmm4 ; xmm1 ^= xmm4 + ; xmm1[63:32] == w[i+11] == RotWord(SubWord(w[i+5]))^Rcon^w[i+5]^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm1[31:0] == w[i+10] == RotWord(SubWord(w[i+5]))^Rcon^w[i+4]^w[i+3]^w[i+2]^w[i+1]^w[i] + + ret +aes192_expand_key_internal endp + +aes192_derive_decryption_keys_internal proc + movdqa xmm5, [rcx] + movdqa xmm4, [rcx + 0C0h] + movdqa [rdx], xmm4 + movdqa [rdx + 0C0h], xmm5 + + aesimc xmm5, [rcx + 10h] + aesimc xmm4, [rcx + 0B0h] + movdqa [rdx + 10h], xmm4 + movdqa [rdx + 0B0h], xmm5 + + aesimc xmm5, [rcx + 20h] + aesimc xmm4, [rcx + 0A0h] + movdqa [rdx + 20h], xmm4 + movdqa [rdx + 0A0h], xmm5 + + aesimc xmm5, [rcx + 30h] + aesimc xmm4, [rcx + 90h] + movdqa [rdx + 30h], xmm4 + movdqa [rdx + 90h], xmm5 + + aesimc xmm5, [rcx + 40h] + aesimc xmm4, [rcx + 80h] + movdqa [rdx + 40h], xmm4 + movdqa [rdx + 80h], xmm5 + + aesimc xmm5, [rcx + 50h] + aesimc xmm4, [rcx + 70h] + movdqa [rdx + 50h], xmm4 + movdqa [rdx + 70h], xmm5 + + aesimc xmm5, [rcx + 60h] + movdqa [rdx + 60h], xmm5 + + ret +aes192_derive_decryption_keys_internal endp + +end diff --git a/aes/src/asm64/aes256.asm b/aes/src/asm64/aes256.asm new file mode 100644 index 0000000..33cb7f2 --- /dev/null +++ b/aes/src/asm64/aes256.asm @@ -0,0 +1,290 @@ +; Copyright (c) 2026 Egor Tensin <egor@tensin.name> +; This file is part of the "AES tools" project. +; For details, see https://github.com/egor-tensin/aes-tools. +; Distributed under the MIT License. + +; Copied from asm/aes256.asm + +.code + +aes256_encrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesenc xmm0, [rdx + 10h] + aesenc xmm0, [rdx + 20h] + aesenc xmm0, [rdx + 30h] + aesenc xmm0, [rdx + 40h] + aesenc xmm0, [rdx + 50h] + aesenc xmm0, [rdx + 60h] + aesenc xmm0, [rdx + 70h] + aesenc xmm0, [rdx + 80h] + aesenc xmm0, [rdx + 90h] + aesenc xmm0, [rdx + 0A0h] + aesenc xmm0, [rdx + 0B0h] + aesenc xmm0, [rdx + 0C0h] + aesenc xmm0, [rdx + 0D0h] + aesenclast xmm0, [rdx + 0E0h] + ret +aes256_encrypt_block_internal endp + +aes256_decrypt_block_internal proc + movdqa xmm0, [rcx] + pxor xmm0, [rdx] + aesdec xmm0, [rdx + 10h] + aesdec xmm0, [rdx + 20h] + aesdec xmm0, [rdx + 30h] + aesdec xmm0, [rdx + 40h] + aesdec xmm0, [rdx + 50h] + aesdec xmm0, [rdx + 60h] + aesdec xmm0, [rdx + 70h] + aesdec xmm0, [rdx + 80h] + aesdec xmm0, [rdx + 90h] + aesdec xmm0, [rdx + 0A0h] + aesdec xmm0, [rdx + 0B0h] + aesdec xmm0, [rdx + 0C0h] + aesdec xmm0, [rdx + 0D0h] + aesdeclast xmm0, [rdx + 0E0h] + ret +aes256_decrypt_block_internal endp + +aes256_expand_key_internal proc + ; A "word" (in terms of the FIPS 187 standard) is a 32-bit block. + ; Words are denoted by `w[N]`. + ; + ; A key schedule is composed of 14 "regular" keys and a dumb key for + ; the "whitening" step. + ; + ; A key schedule is thus composed of 60 "words". + ; The FIPS standard includes an algorithm to calculate these words via + ; a simple loop: + ; + ; i = 8 + ; while i < 60: + ; temp = w[i - 1] + ; if i % 8 == 0: + ; temp = SubWord(RotWord(temp))^Rcon + ; elif i % 8 == 4: + ; temp = SubWord(temp) + ; w[i] = w[i - 8]^temp + ; i = i + 1 + ; + ; The loop above may be unrolled like this: + ; + ; w[8] = SubWord(RotWord(w[7]))^Rcon^w[0] + ; w[9] = w[8]^w[1] + ; = SubWord(RotWord(w[7]))^Rcon^w[1]^w[0] + ; w[10] = w[9]^w[2] + ; = SubWord(RotWord(w[7]))^Rcon^w[2]^w[1]^w[0] + ; w[11] = w[10]^w[3] + ; = SubWord(RotWord(w[7]))^Rcon^w[3]^w[2]^w[1]^w[0] + ; w[12] = SubWord(w[11])^w[4] + ; w[13] = w[12]^w[5] + ; = SubWord(w[11])^w[5]^w[4] + ; w[14] = w[13]^w[6] + ; = SubWord(w[11])^w[6]^w[5]^w[4] + ; w[15] = w[14]^w[7] + ; = SubWord(w[11])^w[7]^w[6]^w[5]^w[4] + ; w[16] = SubWord(RotWord(w[15]))^Rcon^w[8] + ; w[17] = w[16]^w[9] + ; = SubWord(RotWord(w[15]))^Rcon^w[9]^w[8] + ; w[18] = w[17]^w[10] + ; = SubWord(RotWord(w[15]))^Rcon^w[10]^w[9]^w[8] + ; w[19] = w[18]^w[11] + ; = SubWord(RotWord(w[15]))^Rcon^w[11]^w[10]^w[9]^w[8] + ; w[20] = SubWord(w[19])^w[12] + ; w[21] = w[20]^w[13] + ; = SubWord(w[19])^w[13]^w[12] + ; w[22] = w[21]^w[14] + ; = SubWord(w[19])^w[14]^w[13]^w[12] + ; w[23] = w[22]^w[15] + ; = SubWord(w[19])^w[15]^w[14]^w[13]^w[12] + ; + ; ... and so on. + ; + ; The Intel AES-NI instruction set facilitates calculating SubWord + ; and RotWord using `aeskeygenassist`, which is used in this routine. + ; + ; Preconditions: + ; * xmm1[127:96] == w[7], + ; * xmm1[95:64] == w[6], + ; * xmm1[63:32] == w[5], + ; * xmm1[31:0] == w[4], + ; * xmm0[127:96] == w[3], + ; * xmm0[95:64] == w[2], + ; * xmm0[63:32] == w[1], + ; * xmm0[31:0] == w[0]. + + movdqa xmm0, [rcx] + movdqa xmm1, [rdx] + + movdqa [r8], xmm0 ; sets w[0], w[1], w[2], w[3] + movdqa [r8 + 10h], xmm1 ; sets w[4], w[5], w[6], w[7] + lea r8, [r8 + 20h] ; r8 = &w[8] + + aeskeygenassist xmm5, xmm1, 1h ; xmm5[127:96] = RotWord(SubWord(w[7]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[8], w[9], w[10], w[11] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[11]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[12], w[13], w[14], w[15] + + aeskeygenassist xmm5, xmm1, 2h ; xmm5[127:96] = RotWord(SubWord(w[15]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[16], w[17], w[18], w[19] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[19]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[20], w[21], w[22], w[23] + + aeskeygenassist xmm5, xmm1, 4h ; xmm5[127:96] = RotWord(SubWord(w[23]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[24], w[25], w[26], w[27] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[27]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[28], w[29], w[30], w[31] + + aeskeygenassist xmm5, xmm1, 8h ; xmm5[127:96] = RotWord(SubWord(w[31]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[32], w[33], w[34], w[35] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[35]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[36], w[37], w[38], w[39] + + aeskeygenassist xmm5, xmm1, 10h ; xmm5[127:96] = RotWord(SubWord(w[39]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[40], w[41], w[42], w[43] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[43]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[44], w[45], w[46], w[47] + + aeskeygenassist xmm5, xmm1, 20h ; xmm5[127:96] = RotWord(SubWord(w[47]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[48], w[49], w[50], w[51] + + aeskeygenassist xmm5, xmm1, 0 ; xmm5[95:64] = SubWord(w[51]) + pshufd xmm5, xmm5, 0AAh ; xmm5[127:96] = xmm5[63:32] = xmm5[31:0] = xmm5[95:64] + call aes256_keygen_assist ; sets w[52], w[53], w[54], w[55] + + aeskeygenassist xmm5, xmm1, 40h ; xmm5[127:96] = RotWord(SubWord(w[55]))^Rcon + pshufd xmm5, xmm5, 0FFh ; xmm5[95:64] = xmm5[63:32] = xmm5[31:0] = xmm5[127:96] + call aes256_keygen_assist ; sets w[56], w[57], w[58], w[59] + + ret + +aes256_keygen_assist: + ; Preconditions: + ; * xmm1[127:96] == w[i+7], + ; * xmm1[95:64] == w[i+6], + ; * xmm1[63:32] == w[i+5], + ; * xmm1[31:0] == w[i+4], + ; * xmm0[127:96] == w[i+3], + ; * xmm0[95:64] == w[i+2], + ; * xmm0[63:32] == w[i+1], + ; * xmm0[31:0] == w[i], + ; * xmm5[127:96] == xmm5[95:64] == xmm5[63:32] == xmm5[31:0] == HWGEN, + ; where HWGEN is either RotWord(SubWord(w[i+7]))^Rcon or SubWord(w[i+7]), + ; depending on the number of the round being processed, + ; * r8 == &w[i+8]. + ; + ; Postconditions: + ; * xmm1[127:96] == w[i+11] == HWGEN^w[i+3]^w[i+2]^w[i+1]^w[i], + ; * xmm1[95:64] == w[i+10] == HWGEN^w[i+2]^w[i+1]^w[i], + ; * xmm1[63:32] == w[i+9] == HWGEN^w[i+1]^w[i], + ; * xmm1[31:0] == w[i+8] == HWGEN^w[i], + ; * xmm0[127:96] == w[i+7], + ; * xmm0[95:64] == w[i+6], + ; * xmm0[63:32] == w[i+5], + ; * xmm0[31:0] == w[i+4], + ; * r8 == &w[i+12], + ; * the value in xmm4 is also modified. + + ; Calculate + ; w[i+3]^w[i+2]^w[i+1]^w[i], + ; w[i+2]^w[i+1]^w[i], + ; w[i+1]^w[i] and + ; w[i]. + movdqa xmm4, xmm0 ; xmm4 = xmm0 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + pslldq xmm4, 4 ; xmm4 <<= 32 + pxor xmm0, xmm4 ; xmm0 ^= xmm4 + ; xmm0[127:96] == w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+1]^w[i] + ; xmm0[31:0] == w[i] + + ; Calculate + ; HWGEN^w[i+3]^w[i+2]^w[i+1]^w[i], + ; HWGEN^w[i+2]^w[i+1]^w[i], + ; HWGEN^w[i+1]^w[i] and + ; HWGEN^w[i]. + pxor xmm0, xmm5 ; xmm0 ^= xmm5 + ; xmm0[127:96] == w[i+11] == HWGEN^w[i+3]^w[i+2]^w[i+1]^w[i] + ; xmm0[95:64] == w[i+10] == HWGEN^w[i+2]^w[i+1]^w[i] + ; xmm0[63:32] == w[i+9] == HWGEN^w[i+1]^w[i] + ; xmm0[31:0] == w[i+8] == HWGEN^w[i] + + ; Set w[i+8], w[i+9], w[i+10] and w[i+11]. + movdqa [r8], xmm0 ; w[i+8] = HWGEN^w[i] + ; w[i+9] = HWGEN^w[i+1]^w[i] + ; w[i+10] = HWGEN^w[i+2]^w[i+1]^w[i] + ; w[i+11] = HWGEN^w[i+3]^w[i+2]^w[i+1]^w[i] + add r8, 10h ; rcx = &w[i+12] + + ; Swap the values in xmm0 and xmm1. + pxor xmm0, xmm1 + pxor xmm1, xmm0 + pxor xmm0, xmm1 + + ret +aes256_expand_key_internal endp + +aes256_derive_decryption_keys_internal proc + movdqa xmm5, [rcx] + movdqa xmm4, [rcx + 0E0h] + movdqa [rdx], xmm4 + movdqa [rdx + 0E0h], xmm5 + + aesimc xmm5, [rcx + 10h] + aesimc xmm4, [rcx + 0D0h] + movdqa [rdx + 10h], xmm4 + movdqa [rdx + 0D0h], xmm5 + + aesimc xmm5, [rcx + 20h] + aesimc xmm4, [rcx + 0C0h] + movdqa [rdx + 20h], xmm4 + movdqa [rdx + 0C0h], xmm5 + + aesimc xmm5, [rcx + 30h] + aesimc xmm4, [rcx + 0B0h] + movdqa [rdx + 30h], xmm4 + movdqa [rdx + 0B0h], xmm5 + + aesimc xmm5, [rcx + 40h] + aesimc xmm4, [rcx + 0A0h] + movdqa [rdx + 40h], xmm4 + movdqa [rdx + 0A0h], xmm5 + + aesimc xmm5, [rcx + 50h] + aesimc xmm4, [rcx + 90h] + movdqa [rdx + 50h], xmm4 + movdqa [rdx + 90h], xmm5 + + aesimc xmm5, [rcx + 60h] + aesimc xmm4, [rcx + 80h] + movdqa [rdx + 60h], xmm4 + movdqa [rdx + 80h], xmm5 + + aesimc xmm5, [rcx + 70h] + movdqa [rdx + 70h], xmm5 + + ret +aes256_derive_decryption_keys_internal endp + +end |