<?php

[0] Fix | Delete

[1] Fix | Delete

if (class_exists('ParagonIE_Sodium_Core_AES', false)) {

[2] Fix | Delete

return;

[3] Fix | Delete

}

[4] Fix | Delete

[5] Fix | Delete

/**

[6] Fix | Delete

* Bitsliced implementation of the AES block cipher.

[7] Fix | Delete

*

[8] Fix | Delete

* Based on the implementation provided by BearSSL.

[9] Fix | Delete

*

[10] Fix | Delete

* @internal This should only be used by sodium_compat

[11] Fix | Delete

*/

[12] Fix | Delete

class ParagonIE_Sodium_Core_AES extends ParagonIE_Sodium_Core_Util

[13] Fix | Delete

{

[14] Fix | Delete

/**

[15] Fix | Delete

* @var int[] AES round constants

[16] Fix | Delete

*/

[17] Fix | Delete

private static $Rcon = array(

[18] Fix | Delete

0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36

[19] Fix | Delete

);

[20] Fix | Delete

[21] Fix | Delete

/**

[22] Fix | Delete

* Mutates the values of $q!

[23] Fix | Delete

*

[24] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[25] Fix | Delete

* @return void

[26] Fix | Delete

*/

[27] Fix | Delete

public static function sbox(ParagonIE_Sodium_Core_AES_Block $q)

[28] Fix | Delete

{

[29] Fix | Delete

/**

[30] Fix | Delete

* @var int $x0

[31] Fix | Delete

* @var int $x1

[32] Fix | Delete

* @var int $x2

[33] Fix | Delete

* @var int $x3

[34] Fix | Delete

* @var int $x4

[35] Fix | Delete

* @var int $x5

[36] Fix | Delete

* @var int $x6

[37] Fix | Delete

* @var int $x7

[38] Fix | Delete

*/

[39] Fix | Delete

$x0 = $q[7] & self::U32_MAX;

[40] Fix | Delete

$x1 = $q[6] & self::U32_MAX;

[41] Fix | Delete

$x2 = $q[5] & self::U32_MAX;

[42] Fix | Delete

$x3 = $q[4] & self::U32_MAX;

[43] Fix | Delete

$x4 = $q[3] & self::U32_MAX;

[44] Fix | Delete

$x5 = $q[2] & self::U32_MAX;

[45] Fix | Delete

$x6 = $q[1] & self::U32_MAX;

[46] Fix | Delete

$x7 = $q[0] & self::U32_MAX;

[47] Fix | Delete

[48] Fix | Delete

$y14 = $x3 ^ $x5;

[49] Fix | Delete

$y13 = $x0 ^ $x6;

[50] Fix | Delete

$y9 = $x0 ^ $x3;

[51] Fix | Delete

$y8 = $x0 ^ $x5;

[52] Fix | Delete

$t0 = $x1 ^ $x2;

[53] Fix | Delete

$y1 = $t0 ^ $x7;

[54] Fix | Delete

$y4 = $y1 ^ $x3;

[55] Fix | Delete

$y12 = $y13 ^ $y14;

[56] Fix | Delete

$y2 = $y1 ^ $x0;

[57] Fix | Delete

$y5 = $y1 ^ $x6;

[58] Fix | Delete

$y3 = $y5 ^ $y8;

[59] Fix | Delete

$t1 = $x4 ^ $y12;

[60] Fix | Delete

$y15 = $t1 ^ $x5;

[61] Fix | Delete

$y20 = $t1 ^ $x1;

[62] Fix | Delete

$y6 = $y15 ^ $x7;

[63] Fix | Delete

$y10 = $y15 ^ $t0;

[64] Fix | Delete

$y11 = $y20 ^ $y9;

[65] Fix | Delete

$y7 = $x7 ^ $y11;

[66] Fix | Delete

$y17 = $y10 ^ $y11;

[67] Fix | Delete

$y19 = $y10 ^ $y8;

[68] Fix | Delete

$y16 = $t0 ^ $y11;

[69] Fix | Delete

$y21 = $y13 ^ $y16;

[70] Fix | Delete

$y18 = $x0 ^ $y16;

[71] Fix | Delete

[72] Fix | Delete

/*

[73] Fix | Delete

* Non-linear section.

[74] Fix | Delete

*/

[75] Fix | Delete

$t2 = $y12 & $y15;

[76] Fix | Delete

$t3 = $y3 & $y6;

[77] Fix | Delete

$t4 = $t3 ^ $t2;

[78] Fix | Delete

$t5 = $y4 & $x7;

[79] Fix | Delete

$t6 = $t5 ^ $t2;

[80] Fix | Delete

$t7 = $y13 & $y16;

[81] Fix | Delete

$t8 = $y5 & $y1;

[82] Fix | Delete

$t9 = $t8 ^ $t7;

[83] Fix | Delete

$t10 = $y2 & $y7;

[84] Fix | Delete

$t11 = $t10 ^ $t7;

[85] Fix | Delete

$t12 = $y9 & $y11;

[86] Fix | Delete

$t13 = $y14 & $y17;

[87] Fix | Delete

$t14 = $t13 ^ $t12;

[88] Fix | Delete

$t15 = $y8 & $y10;

[89] Fix | Delete

$t16 = $t15 ^ $t12;

[90] Fix | Delete

$t17 = $t4 ^ $t14;

[91] Fix | Delete

$t18 = $t6 ^ $t16;

[92] Fix | Delete

$t19 = $t9 ^ $t14;

[93] Fix | Delete

$t20 = $t11 ^ $t16;

[94] Fix | Delete

$t21 = $t17 ^ $y20;

[95] Fix | Delete

$t22 = $t18 ^ $y19;

[96] Fix | Delete

$t23 = $t19 ^ $y21;

[97] Fix | Delete

$t24 = $t20 ^ $y18;

[98] Fix | Delete

[99] Fix | Delete

$t25 = $t21 ^ $t22;

[100] Fix | Delete

$t26 = $t21 & $t23;

[101] Fix | Delete

$t27 = $t24 ^ $t26;

[102] Fix | Delete

$t28 = $t25 & $t27;

[103] Fix | Delete

$t29 = $t28 ^ $t22;

[104] Fix | Delete

$t30 = $t23 ^ $t24;

[105] Fix | Delete

$t31 = $t22 ^ $t26;

[106] Fix | Delete

$t32 = $t31 & $t30;

[107] Fix | Delete

$t33 = $t32 ^ $t24;

[108] Fix | Delete

$t34 = $t23 ^ $t33;

[109] Fix | Delete

$t35 = $t27 ^ $t33;

[110] Fix | Delete

$t36 = $t24 & $t35;

[111] Fix | Delete

$t37 = $t36 ^ $t34;

[112] Fix | Delete

$t38 = $t27 ^ $t36;

[113] Fix | Delete

$t39 = $t29 & $t38;

[114] Fix | Delete

$t40 = $t25 ^ $t39;

[115] Fix | Delete

[116] Fix | Delete

$t41 = $t40 ^ $t37;

[117] Fix | Delete

$t42 = $t29 ^ $t33;

[118] Fix | Delete

$t43 = $t29 ^ $t40;

[119] Fix | Delete

$t44 = $t33 ^ $t37;

[120] Fix | Delete

$t45 = $t42 ^ $t41;

[121] Fix | Delete

$z0 = $t44 & $y15;

[122] Fix | Delete

$z1 = $t37 & $y6;

[123] Fix | Delete

$z2 = $t33 & $x7;

[124] Fix | Delete

$z3 = $t43 & $y16;

[125] Fix | Delete

$z4 = $t40 & $y1;

[126] Fix | Delete

$z5 = $t29 & $y7;

[127] Fix | Delete

$z6 = $t42 & $y11;

[128] Fix | Delete

$z7 = $t45 & $y17;

[129] Fix | Delete

$z8 = $t41 & $y10;

[130] Fix | Delete

$z9 = $t44 & $y12;

[131] Fix | Delete

$z10 = $t37 & $y3;

[132] Fix | Delete

$z11 = $t33 & $y4;

[133] Fix | Delete

$z12 = $t43 & $y13;

[134] Fix | Delete

$z13 = $t40 & $y5;

[135] Fix | Delete

$z14 = $t29 & $y2;

[136] Fix | Delete

$z15 = $t42 & $y9;

[137] Fix | Delete

$z16 = $t45 & $y14;

[138] Fix | Delete

$z17 = $t41 & $y8;

[139] Fix | Delete

[140] Fix | Delete

/*

[141] Fix | Delete

* Bottom linear transformation.

[142] Fix | Delete

*/

[143] Fix | Delete

$t46 = $z15 ^ $z16;

[144] Fix | Delete

$t47 = $z10 ^ $z11;

[145] Fix | Delete

$t48 = $z5 ^ $z13;

[146] Fix | Delete

$t49 = $z9 ^ $z10;

[147] Fix | Delete

$t50 = $z2 ^ $z12;

[148] Fix | Delete

$t51 = $z2 ^ $z5;

[149] Fix | Delete

$t52 = $z7 ^ $z8;

[150] Fix | Delete

$t53 = $z0 ^ $z3;

[151] Fix | Delete

$t54 = $z6 ^ $z7;

[152] Fix | Delete

$t55 = $z16 ^ $z17;

[153] Fix | Delete

$t56 = $z12 ^ $t48;

[154] Fix | Delete

$t57 = $t50 ^ $t53;

[155] Fix | Delete

$t58 = $z4 ^ $t46;

[156] Fix | Delete

$t59 = $z3 ^ $t54;

[157] Fix | Delete

$t60 = $t46 ^ $t57;

[158] Fix | Delete

$t61 = $z14 ^ $t57;

[159] Fix | Delete

$t62 = $t52 ^ $t58;

[160] Fix | Delete

$t63 = $t49 ^ $t58;

[161] Fix | Delete

$t64 = $z4 ^ $t59;

[162] Fix | Delete

$t65 = $t61 ^ $t62;

[163] Fix | Delete

$t66 = $z1 ^ $t63;

[164] Fix | Delete

$s0 = $t59 ^ $t63;

[165] Fix | Delete

$s6 = $t56 ^ ~$t62;

[166] Fix | Delete

$s7 = $t48 ^ ~$t60;

[167] Fix | Delete

$t67 = $t64 ^ $t65;

[168] Fix | Delete

$s3 = $t53 ^ $t66;

[169] Fix | Delete

$s4 = $t51 ^ $t66;

[170] Fix | Delete

$s5 = $t47 ^ $t65;

[171] Fix | Delete

$s1 = $t64 ^ ~$s3;

[172] Fix | Delete

$s2 = $t55 ^ ~$t67;

[173] Fix | Delete

[174] Fix | Delete

$q[7] = $s0 & self::U32_MAX;

[175] Fix | Delete

$q[6] = $s1 & self::U32_MAX;

[176] Fix | Delete

$q[5] = $s2 & self::U32_MAX;

[177] Fix | Delete

$q[4] = $s3 & self::U32_MAX;

[178] Fix | Delete

$q[3] = $s4 & self::U32_MAX;

[179] Fix | Delete

$q[2] = $s5 & self::U32_MAX;

[180] Fix | Delete

$q[1] = $s6 & self::U32_MAX;

[181] Fix | Delete

$q[0] = $s7 & self::U32_MAX;

[182] Fix | Delete

}

[183] Fix | Delete

[184] Fix | Delete

/**

[185] Fix | Delete

* Mutates the values of $q!

[186] Fix | Delete

*

[187] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[188] Fix | Delete

* @return void

[189] Fix | Delete

*/

[190] Fix | Delete

public static function invSbox(ParagonIE_Sodium_Core_AES_Block $q)

[191] Fix | Delete

{

[192] Fix | Delete

self::processInversion($q);

[193] Fix | Delete

self::sbox($q);

[194] Fix | Delete

self::processInversion($q);

[195] Fix | Delete

}

[196] Fix | Delete

[197] Fix | Delete

/**

[198] Fix | Delete

* This is some boilerplate code needed to invert an S-box. Rather than repeat the code

[199] Fix | Delete

* twice, I moved it to a protected method.

[200] Fix | Delete

*

[201] Fix | Delete

* Mutates $q

[202] Fix | Delete

*

[203] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[204] Fix | Delete

* @return void

[205] Fix | Delete

*/

[206] Fix | Delete

protected static function processInversion(ParagonIE_Sodium_Core_AES_Block $q)

[207] Fix | Delete

{

[208] Fix | Delete

$q0 = (~$q[0]) & self::U32_MAX;

[209] Fix | Delete

$q1 = (~$q[1]) & self::U32_MAX;

[210] Fix | Delete

$q2 = $q[2] & self::U32_MAX;

[211] Fix | Delete

$q3 = $q[3] & self::U32_MAX;

[212] Fix | Delete

$q4 = $q[4] & self::U32_MAX;

[213] Fix | Delete

$q5 = (~$q[5]) & self::U32_MAX;

[214] Fix | Delete

$q6 = (~$q[6]) & self::U32_MAX;

[215] Fix | Delete

$q7 = $q[7] & self::U32_MAX;

[216] Fix | Delete

$q[7] = ($q1 ^ $q4 ^ $q6) & self::U32_MAX;

[217] Fix | Delete

$q[6] = ($q0 ^ $q3 ^ $q5) & self::U32_MAX;

[218] Fix | Delete

$q[5] = ($q7 ^ $q2 ^ $q4) & self::U32_MAX;

[219] Fix | Delete

$q[4] = ($q6 ^ $q1 ^ $q3) & self::U32_MAX;

[220] Fix | Delete

$q[3] = ($q5 ^ $q0 ^ $q2) & self::U32_MAX;

[221] Fix | Delete

$q[2] = ($q4 ^ $q7 ^ $q1) & self::U32_MAX;

[222] Fix | Delete

$q[1] = ($q3 ^ $q6 ^ $q0) & self::U32_MAX;

[223] Fix | Delete

$q[0] = ($q2 ^ $q5 ^ $q7) & self::U32_MAX;

[224] Fix | Delete

}

[225] Fix | Delete

[226] Fix | Delete

/**

[227] Fix | Delete

* @param int $x

[228] Fix | Delete

* @return int

[229] Fix | Delete

*/

[230] Fix | Delete

public static function subWord($x)

[231] Fix | Delete

{

[232] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::fromArray(

[233] Fix | Delete

array($x, $x, $x, $x, $x, $x, $x, $x)

[234] Fix | Delete

);

[235] Fix | Delete

$q->orthogonalize();

[236] Fix | Delete

self::sbox($q);

[237] Fix | Delete

$q->orthogonalize();

[238] Fix | Delete

return $q[0] & self::U32_MAX;

[239] Fix | Delete

}

[240] Fix | Delete

[241] Fix | Delete

/**

[242] Fix | Delete

* Calculate the key schedule from a given random key

[243] Fix | Delete

*

[244] Fix | Delete

* @param string $key

[245] Fix | Delete

* @return ParagonIE_Sodium_Core_AES_KeySchedule

[246] Fix | Delete

* @throws SodiumException

[247] Fix | Delete

*/

[248] Fix | Delete

public static function keySchedule($key)

[249] Fix | Delete

{

[250] Fix | Delete

$key_len = self::strlen($key);

[251] Fix | Delete

switch ($key_len) {

[252] Fix | Delete

case 16:

[253] Fix | Delete

$num_rounds = 10;

[254] Fix | Delete

break;

[255] Fix | Delete

case 24:

[256] Fix | Delete

$num_rounds = 12;

[257] Fix | Delete

break;

[258] Fix | Delete

case 32:

[259] Fix | Delete

$num_rounds = 14;

[260] Fix | Delete

break;

[261] Fix | Delete

default:

[262] Fix | Delete

throw new SodiumException('Invalid key length: ' . $key_len);

[263] Fix | Delete

}

[264] Fix | Delete

$skey = array();

[265] Fix | Delete

$comp_skey = array();

[266] Fix | Delete

$nk = $key_len >> 2;

[267] Fix | Delete

$nkf = ($num_rounds + 1) << 2;

[268] Fix | Delete

$tmp = 0;

[269] Fix | Delete

[270] Fix | Delete

for ($i = 0; $i < $nk; ++$i) {

[271] Fix | Delete

$tmp = self::load_4(self::substr($key, $i << 2, 4));

[272] Fix | Delete

$skey[($i << 1)] = $tmp;

[273] Fix | Delete

$skey[($i << 1) + 1] = $tmp;

[274] Fix | Delete

}

[275] Fix | Delete

[276] Fix | Delete

for ($i = $nk, $j = 0, $k = 0; $i < $nkf; ++$i) {

[277] Fix | Delete

if ($j === 0) {

[278] Fix | Delete

$tmp = (($tmp & 0xff) << 24) | ($tmp >> 8);

[279] Fix | Delete

$tmp = (self::subWord($tmp) ^ self::$Rcon[$k]) & self::U32_MAX;

[280] Fix | Delete

} elseif ($nk > 6 && $j === 4) {

[281] Fix | Delete

$tmp = self::subWord($tmp);

[282] Fix | Delete

}

[283] Fix | Delete

$tmp ^= $skey[($i - $nk) << 1];

[284] Fix | Delete

$skey[($i << 1)] = $tmp & self::U32_MAX;

[285] Fix | Delete

$skey[($i << 1) + 1] = $tmp & self::U32_MAX;

[286] Fix | Delete

if (++$j === $nk) {

[287] Fix | Delete

/** @psalm-suppress LoopInvalidation */

[288] Fix | Delete

$j = 0;

[289] Fix | Delete

++$k;

[290] Fix | Delete

}

[291] Fix | Delete

}

[292] Fix | Delete

for ($i = 0; $i < $nkf; $i += 4) {

[293] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::fromArray(

[294] Fix | Delete

array_slice($skey, $i << 1, 8)

[295] Fix | Delete

);

[296] Fix | Delete

$q->orthogonalize();

[297] Fix | Delete

// We have to overwrite $skey since we're not using C pointers like BearSSL did

[298] Fix | Delete

for ($j = 0; $j < 8; ++$j) {

[299] Fix | Delete

$skey[($i << 1) + $j] = $q[$j];

[300] Fix | Delete

}

[301] Fix | Delete

}

[302] Fix | Delete

for ($i = 0, $j = 0; $i < $nkf; ++$i, $j += 2) {

[303] Fix | Delete

$comp_skey[$i] = ($skey[$j] & 0x55555555)

[304] Fix | Delete

| ($skey[$j + 1] & 0xAAAAAAAA);

[305] Fix | Delete

}

[306] Fix | Delete

return new ParagonIE_Sodium_Core_AES_KeySchedule($comp_skey, $num_rounds);

[307] Fix | Delete

}

[308] Fix | Delete

[309] Fix | Delete

/**

[310] Fix | Delete

* Mutates $q

[311] Fix | Delete

*

[312] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_KeySchedule $skey

[313] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[314] Fix | Delete

* @param int $offset

[315] Fix | Delete

* @return void

[316] Fix | Delete

*/

[317] Fix | Delete

public static function addRoundKey(

[318] Fix | Delete

ParagonIE_Sodium_Core_AES_Block $q,

[319] Fix | Delete

ParagonIE_Sodium_Core_AES_KeySchedule $skey,

[320] Fix | Delete

$offset = 0

[321] Fix | Delete

) {

[322] Fix | Delete

$block = $skey->getRoundKey($offset);

[323] Fix | Delete

for ($j = 0; $j < 8; ++$j) {

[324] Fix | Delete

$q[$j] = ($q[$j] ^ $block[$j]) & ParagonIE_Sodium_Core_Util::U32_MAX;

[325] Fix | Delete

}

[326] Fix | Delete

}

[327] Fix | Delete

[328] Fix | Delete

/**

[329] Fix | Delete

* This mainly exists for testing, as we need the round key features for AEGIS.

[330] Fix | Delete

*

[331] Fix | Delete

* @param string $message

[332] Fix | Delete

* @param string $key

[333] Fix | Delete

* @return string

[334] Fix | Delete

* @throws SodiumException

[335] Fix | Delete

*/

[336] Fix | Delete

public static function decryptBlockECB($message, $key)

[337] Fix | Delete

{

[338] Fix | Delete

if (self::strlen($message) !== 16) {

[339] Fix | Delete

throw new SodiumException('decryptBlockECB() expects a 16 byte message');

[340] Fix | Delete

}

[341] Fix | Delete

$skey = self::keySchedule($key)->expand();

[342] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::init();

[343] Fix | Delete

$q[0] = self::load_4(self::substr($message, 0, 4));

[344] Fix | Delete

$q[2] = self::load_4(self::substr($message, 4, 4));

[345] Fix | Delete

$q[4] = self::load_4(self::substr($message, 8, 4));

[346] Fix | Delete

$q[6] = self::load_4(self::substr($message, 12, 4));

[347] Fix | Delete

[348] Fix | Delete

$q->orthogonalize();

[349] Fix | Delete

self::bitsliceDecryptBlock($skey, $q);

[350] Fix | Delete

$q->orthogonalize();

[351] Fix | Delete

[352] Fix | Delete

return self::store32_le($q[0]) .

[353] Fix | Delete

self::store32_le($q[2]) .

[354] Fix | Delete

self::store32_le($q[4]) .

[355] Fix | Delete

self::store32_le($q[6]);

[356] Fix | Delete

}

[357] Fix | Delete

[358] Fix | Delete

/**

[359] Fix | Delete

* This mainly exists for testing, as we need the round key features for AEGIS.

[360] Fix | Delete

*

[361] Fix | Delete

* @param string $message

[362] Fix | Delete

* @param string $key

[363] Fix | Delete

* @return string

[364] Fix | Delete

* @throws SodiumException

[365] Fix | Delete

*/

[366] Fix | Delete

public static function encryptBlockECB($message, $key)

[367] Fix | Delete

{

[368] Fix | Delete

if (self::strlen($message) !== 16) {

[369] Fix | Delete

throw new SodiumException('encryptBlockECB() expects a 16 byte message');

[370] Fix | Delete

}

[371] Fix | Delete

$comp_skey = self::keySchedule($key);

[372] Fix | Delete

$skey = $comp_skey->expand();

[373] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::init();

[374] Fix | Delete

$q[0] = self::load_4(self::substr($message, 0, 4));

[375] Fix | Delete

$q[2] = self::load_4(self::substr($message, 4, 4));

[376] Fix | Delete

$q[4] = self::load_4(self::substr($message, 8, 4));

[377] Fix | Delete

$q[6] = self::load_4(self::substr($message, 12, 4));

[378] Fix | Delete

[379] Fix | Delete

$q->orthogonalize();

[380] Fix | Delete

self::bitsliceEncryptBlock($skey, $q);

[381] Fix | Delete

$q->orthogonalize();

[382] Fix | Delete

[383] Fix | Delete

return self::store32_le($q[0]) .

[384] Fix | Delete

self::store32_le($q[2]) .

[385] Fix | Delete

self::store32_le($q[4]) .

[386] Fix | Delete

self::store32_le($q[6]);

[387] Fix | Delete

}

[388] Fix | Delete

[389] Fix | Delete

/**

[390] Fix | Delete

* Mutates $q

[391] Fix | Delete

*

[392] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Expanded $skey

[393] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[394] Fix | Delete

* @return void

[395] Fix | Delete

*/

[396] Fix | Delete

public static function bitsliceEncryptBlock(

[397] Fix | Delete

ParagonIE_Sodium_Core_AES_Expanded $skey,

[398] Fix | Delete

ParagonIE_Sodium_Core_AES_Block $q

[399] Fix | Delete

) {

[400] Fix | Delete

self::addRoundKey($q, $skey);

[401] Fix | Delete

for ($u = 1; $u < $skey->getNumRounds(); ++$u) {

[402] Fix | Delete

self::sbox($q);

[403] Fix | Delete

$q->shiftRows();

[404] Fix | Delete

$q->mixColumns();

[405] Fix | Delete

self::addRoundKey($q, $skey, ($u << 3));

[406] Fix | Delete

}

[407] Fix | Delete

self::sbox($q);

[408] Fix | Delete

$q->shiftRows();

[409] Fix | Delete

self::addRoundKey($q, $skey, ($skey->getNumRounds() << 3));

[410] Fix | Delete

}

[411] Fix | Delete

[412] Fix | Delete

/**

[413] Fix | Delete

* @param string $x

[414] Fix | Delete

* @param string $y

[415] Fix | Delete

* @return string

[416] Fix | Delete

*/

[417] Fix | Delete

public static function aesRound($x, $y)

[418] Fix | Delete

{

[419] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::init();

[420] Fix | Delete

$q[0] = self::load_4(self::substr($x, 0, 4));

[421] Fix | Delete

$q[2] = self::load_4(self::substr($x, 4, 4));

[422] Fix | Delete

$q[4] = self::load_4(self::substr($x, 8, 4));

[423] Fix | Delete

$q[6] = self::load_4(self::substr($x, 12, 4));

[424] Fix | Delete

[425] Fix | Delete

$rk = ParagonIE_Sodium_Core_AES_Block::init();

[426] Fix | Delete

$rk[0] = $rk[1] = self::load_4(self::substr($y, 0, 4));

[427] Fix | Delete

$rk[2] = $rk[3] = self::load_4(self::substr($y, 4, 4));

[428] Fix | Delete

$rk[4] = $rk[5] = self::load_4(self::substr($y, 8, 4));

[429] Fix | Delete

$rk[6] = $rk[7] = self::load_4(self::substr($y, 12, 4));

[430] Fix | Delete

[431] Fix | Delete

$q->orthogonalize();

[432] Fix | Delete

self::sbox($q);

[433] Fix | Delete

$q->shiftRows();

[434] Fix | Delete

$q->mixColumns();

[435] Fix | Delete

$q->orthogonalize();

[436] Fix | Delete

// add round key without key schedule:

[437] Fix | Delete

for ($i = 0; $i < 8; ++$i) {

[438] Fix | Delete

$q[$i] ^= $rk[$i];

[439] Fix | Delete

}

[440] Fix | Delete

return self::store32_le($q[0]) .

[441] Fix | Delete

self::store32_le($q[2]) .

[442] Fix | Delete

self::store32_le($q[4]) .

[443] Fix | Delete

self::store32_le($q[6]);

[444] Fix | Delete

}

[445] Fix | Delete

[446] Fix | Delete

/**

[447] Fix | Delete

* Process two AES blocks in one shot.

[448] Fix | Delete

*

[449] Fix | Delete

* @param string $b0 First AES block

[450] Fix | Delete

* @param string $rk0 First round key

[451] Fix | Delete

* @param string $b1 Second AES block

[452] Fix | Delete

* @param string $rk1 Second round key

[453] Fix | Delete

* @return string[]

[454] Fix | Delete

*/

[455] Fix | Delete

public static function doubleRound($b0, $rk0, $b1, $rk1)

[456] Fix | Delete

{

[457] Fix | Delete

$q = ParagonIE_Sodium_Core_AES_Block::init();

[458] Fix | Delete

// First block

[459] Fix | Delete

$q[0] = self::load_4(self::substr($b0, 0, 4));

[460] Fix | Delete

$q[2] = self::load_4(self::substr($b0, 4, 4));

[461] Fix | Delete

$q[4] = self::load_4(self::substr($b0, 8, 4));

[462] Fix | Delete

$q[6] = self::load_4(self::substr($b0, 12, 4));

[463] Fix | Delete

// Second block

[464] Fix | Delete

$q[1] = self::load_4(self::substr($b1, 0, 4));

[465] Fix | Delete

$q[3] = self::load_4(self::substr($b1, 4, 4));

[466] Fix | Delete

$q[5] = self::load_4(self::substr($b1, 8, 4));

[467] Fix | Delete

$q[7] = self::load_4(self::substr($b1, 12, 4));;

[468] Fix | Delete

[469] Fix | Delete

$rk = ParagonIE_Sodium_Core_AES_Block::init();

[470] Fix | Delete

// First round key

[471] Fix | Delete

$rk[0] = self::load_4(self::substr($rk0, 0, 4));

[472] Fix | Delete

$rk[2] = self::load_4(self::substr($rk0, 4, 4));

[473] Fix | Delete

$rk[4] = self::load_4(self::substr($rk0, 8, 4));

[474] Fix | Delete

$rk[6] = self::load_4(self::substr($rk0, 12, 4));

[475] Fix | Delete

// Second round key

[476] Fix | Delete

$rk[1] = self::load_4(self::substr($rk1, 0, 4));

[477] Fix | Delete

$rk[3] = self::load_4(self::substr($rk1, 4, 4));

[478] Fix | Delete

$rk[5] = self::load_4(self::substr($rk1, 8, 4));

[479] Fix | Delete

$rk[7] = self::load_4(self::substr($rk1, 12, 4));

[480] Fix | Delete

[481] Fix | Delete

$q->orthogonalize();

[482] Fix | Delete

self::sbox($q);

[483] Fix | Delete

$q->shiftRows();

[484] Fix | Delete

$q->mixColumns();

[485] Fix | Delete

$q->orthogonalize();

[486] Fix | Delete

// add round key without key schedule:

[487] Fix | Delete

for ($i = 0; $i < 8; ++$i) {

[488] Fix | Delete

$q[$i] ^= $rk[$i];

[489] Fix | Delete

}

[490] Fix | Delete

return array(

[491] Fix | Delete

self::store32_le($q[0]) . self::store32_le($q[2]) . self::store32_le($q[4]) . self::store32_le($q[6]),

[492] Fix | Delete

self::store32_le($q[1]) . self::store32_le($q[3]) . self::store32_le($q[5]) . self::store32_le($q[7]),

[493] Fix | Delete

);

[494] Fix | Delete

}

[495] Fix | Delete

[496] Fix | Delete

/**

[497] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Expanded $skey

[498] Fix | Delete

* @param ParagonIE_Sodium_Core_AES_Block $q

[499] Fix | Delete