nx_aes128_wasm.nx source
↩ module page · 240 lines · 13389 B
1// nx_aes128_wasm.nx -- AES-128 ECB (FIPS 197) self-contained for WAT target.
2//
3// Rijndael-128 with 128-bit key, 16-byte block, 10 rounds.
4// ECB mode only -- caller composes CTR/GCM/CBC on top.
5//
6// Implementation: byte-oriented SBox/InvSBox + ShiftRows + MixColumns
7// done as straightforward 4x4 byte ops. No T-tables (slower but
8// smaller code, simpler, side-channel-friendly).
9//
10// API:
11// nx_aes128_encrypt(key_ptr, in_block, scratch_ptr, out_block) -> i64
12// key_ptr -- 16 bytes (128-bit key)
13// in_block -- 16 bytes plaintext
14// scratch_ptr -- >= 256 bytes (key schedule = 11 round keys = 176 bytes)
15// out_block -- 16 bytes ciphertext
16// nx_aes128_decrypt(key_ptr, in_block, scratch_ptr, out_block) -> i64
17// symmetric inverse (uses InvSBox + InvShiftRows + InvMixColumns)
18//
19// Verified against FIPS 197 Appendix C.1 (single-block KAT).
20//
21// license_tier: INDEPENDENT_REDERIVE
22// genealogy_id: international-research-sources/nist/fips_197
23// lineage_id: nishi_aes128_wasm_q11
24
25// === Rijndael S-box (FIPS 197 §5.1.1 / Appendix A) ===
26// Inlined as a switch. 256 entries.
27func _aes_sbox(b: i64) -> i64 {
28 if b == 0 { return 0x63 } if b == 1 { return 0x7c } if b == 2 { return 0x77 } if b == 3 { return 0x7b }
29 if b == 4 { return 0xf2 } if b == 5 { return 0x6b } if b == 6 { return 0x6f } if b == 7 { return 0xc5 }
30 if b == 8 { return 0x30 } if b == 9 { return 0x01 } if b == 10 { return 0x67 } if b == 11 { return 0x2b }
31 if b == 12 { return 0xfe } if b == 13 { return 0xd7 } if b == 14 { return 0xab } if b == 15 { return 0x76 }
32 if b == 16 { return 0xca } if b == 17 { return 0x82 } if b == 18 { return 0xc9 } if b == 19 { return 0x7d }
33 if b == 20 { return 0xfa } if b == 21 { return 0x59 } if b == 22 { return 0x47 } if b == 23 { return 0xf0 }
34 if b == 24 { return 0xad } if b == 25 { return 0xd4 } if b == 26 { return 0xa2 } if b == 27 { return 0xaf }
35 if b == 28 { return 0x9c } if b == 29 { return 0xa4 } if b == 30 { return 0x72 } if b == 31 { return 0xc0 }
36 if b == 32 { return 0xb7 } if b == 33 { return 0xfd } if b == 34 { return 0x93 } if b == 35 { return 0x26 }
37 if b == 36 { return 0x36 } if b == 37 { return 0x3f } if b == 38 { return 0xf7 } if b == 39 { return 0xcc }
38 if b == 40 { return 0x34 } if b == 41 { return 0xa5 } if b == 42 { return 0xe5 } if b == 43 { return 0xf1 }
39 if b == 44 { return 0x71 } if b == 45 { return 0xd8 } if b == 46 { return 0x31 } if b == 47 { return 0x15 }
40 if b == 48 { return 0x04 } if b == 49 { return 0xc7 } if b == 50 { return 0x23 } if b == 51 { return 0xc3 }
41 if b == 52 { return 0x18 } if b == 53 { return 0x96 } if b == 54 { return 0x05 } if b == 55 { return 0x9a }
42 if b == 56 { return 0x07 } if b == 57 { return 0x12 } if b == 58 { return 0x80 } if b == 59 { return 0xe2 }
43 if b == 60 { return 0xeb } if b == 61 { return 0x27 } if b == 62 { return 0xb2 } if b == 63 { return 0x75 }
44 if b == 64 { return 0x09 } if b == 65 { return 0x83 } if b == 66 { return 0x2c } if b == 67 { return 0x1a }
45 if b == 68 { return 0x1b } if b == 69 { return 0x6e } if b == 70 { return 0x5a } if b == 71 { return 0xa0 }
46 if b == 72 { return 0x52 } if b == 73 { return 0x3b } if b == 74 { return 0xd6 } if b == 75 { return 0xb3 }
47 if b == 76 { return 0x29 } if b == 77 { return 0xe3 } if b == 78 { return 0x2f } if b == 79 { return 0x84 }
48 if b == 80 { return 0x53 } if b == 81 { return 0xd1 } if b == 82 { return 0x00 } if b == 83 { return 0xed }
49 if b == 84 { return 0x20 } if b == 85 { return 0xfc } if b == 86 { return 0xb1 } if b == 87 { return 0x5b }
50 if b == 88 { return 0x6a } if b == 89 { return 0xcb } if b == 90 { return 0xbe } if b == 91 { return 0x39 }
51 if b == 92 { return 0x4a } if b == 93 { return 0x4c } if b == 94 { return 0x58 } if b == 95 { return 0xcf }
52 if b == 96 { return 0xd0 } if b == 97 { return 0xef } if b == 98 { return 0xaa } if b == 99 { return 0xfb }
53 if b == 100 { return 0x43 } if b == 101 { return 0x4d } if b == 102 { return 0x33 } if b == 103 { return 0x85 }
54 if b == 104 { return 0x45 } if b == 105 { return 0xf9 } if b == 106 { return 0x02 } if b == 107 { return 0x7f }
55 if b == 108 { return 0x50 } if b == 109 { return 0x3c } if b == 110 { return 0x9f } if b == 111 { return 0xa8 }
56 if b == 112 { return 0x51 } if b == 113 { return 0xa3 } if b == 114 { return 0x40 } if b == 115 { return 0x8f }
57 if b == 116 { return 0x92 } if b == 117 { return 0x9d } if b == 118 { return 0x38 } if b == 119 { return 0xf5 }
58 if b == 120 { return 0xbc } if b == 121 { return 0xb6 } if b == 122 { return 0xda } if b == 123 { return 0x21 }
59 if b == 124 { return 0x10 } if b == 125 { return 0xff } if b == 126 { return 0xf3 } if b == 127 { return 0xd2 }
60 if b == 128 { return 0xcd } if b == 129 { return 0x0c } if b == 130 { return 0x13 } if b == 131 { return 0xec }
61 if b == 132 { return 0x5f } if b == 133 { return 0x97 } if b == 134 { return 0x44 } if b == 135 { return 0x17 }
62 if b == 136 { return 0xc4 } if b == 137 { return 0xa7 } if b == 138 { return 0x7e } if b == 139 { return 0x3d }
63 if b == 140 { return 0x64 } if b == 141 { return 0x5d } if b == 142 { return 0x19 } if b == 143 { return 0x73 }
64 if b == 144 { return 0x60 } if b == 145 { return 0x81 } if b == 146 { return 0x4f } if b == 147 { return 0xdc }
65 if b == 148 { return 0x22 } if b == 149 { return 0x2a } if b == 150 { return 0x90 } if b == 151 { return 0x88 }
66 if b == 152 { return 0x46 } if b == 153 { return 0xee } if b == 154 { return 0xb8 } if b == 155 { return 0x14 }
67 if b == 156 { return 0xde } if b == 157 { return 0x5e } if b == 158 { return 0x0b } if b == 159 { return 0xdb }
68 if b == 160 { return 0xe0 } if b == 161 { return 0x32 } if b == 162 { return 0x3a } if b == 163 { return 0x0a }
69 if b == 164 { return 0x49 } if b == 165 { return 0x06 } if b == 166 { return 0x24 } if b == 167 { return 0x5c }
70 if b == 168 { return 0xc2 } if b == 169 { return 0xd3 } if b == 170 { return 0xac } if b == 171 { return 0x62 }
71 if b == 172 { return 0x91 } if b == 173 { return 0x95 } if b == 174 { return 0xe4 } if b == 175 { return 0x79 }
72 if b == 176 { return 0xe7 } if b == 177 { return 0xc8 } if b == 178 { return 0x37 } if b == 179 { return 0x6d }
73 if b == 180 { return 0x8d } if b == 181 { return 0xd5 } if b == 182 { return 0x4e } if b == 183 { return 0xa9 }
74 if b == 184 { return 0x6c } if b == 185 { return 0x56 } if b == 186 { return 0xf4 } if b == 187 { return 0xea }
75 if b == 188 { return 0x65 } if b == 189 { return 0x7a } if b == 190 { return 0xae } if b == 191 { return 0x08 }
76 if b == 192 { return 0xba } if b == 193 { return 0x78 } if b == 194 { return 0x25 } if b == 195 { return 0x2e }
77 if b == 196 { return 0x1c } if b == 197 { return 0xa6 } if b == 198 { return 0xb4 } if b == 199 { return 0xc6 }
78 if b == 200 { return 0xe8 } if b == 201 { return 0xdd } if b == 202 { return 0x74 } if b == 203 { return 0x1f }
79 if b == 204 { return 0x4b } if b == 205 { return 0xbd } if b == 206 { return 0x8b } if b == 207 { return 0x8a }
80 if b == 208 { return 0x70 } if b == 209 { return 0x3e } if b == 210 { return 0xb5 } if b == 211 { return 0x66 }
81 if b == 212 { return 0x48 } if b == 213 { return 0x03 } if b == 214 { return 0xf6 } if b == 215 { return 0x0e }
82 if b == 216 { return 0x61 } if b == 217 { return 0x35 } if b == 218 { return 0x57 } if b == 219 { return 0xb9 }
83 if b == 220 { return 0x86 } if b == 221 { return 0xc1 } if b == 222 { return 0x1d } if b == 223 { return 0x9e }
84 if b == 224 { return 0xe1 } if b == 225 { return 0xf8 } if b == 226 { return 0x98 } if b == 227 { return 0x11 }
85 if b == 228 { return 0x69 } if b == 229 { return 0xd9 } if b == 230 { return 0x8e } if b == 231 { return 0x94 }
86 if b == 232 { return 0x9b } if b == 233 { return 0x1e } if b == 234 { return 0x87 } if b == 235 { return 0xe9 }
87 if b == 236 { return 0xce } if b == 237 { return 0x55 } if b == 238 { return 0x28 } if b == 239 { return 0xdf }
88 if b == 240 { return 0x8c } if b == 241 { return 0xa1 } if b == 242 { return 0x89 } if b == 243 { return 0x0d }
89 if b == 244 { return 0xbf } if b == 245 { return 0xe6 } if b == 246 { return 0x42 } if b == 247 { return 0x68 }
90 if b == 248 { return 0x41 } if b == 249 { return 0x99 } if b == 250 { return 0x2d } if b == 251 { return 0x0f }
91 if b == 252 { return 0xb0 } if b == 253 { return 0x54 } if b == 254 { return 0xbb }
92 return 0x16
93}
94
95// === Round constants Rcon[i] for key schedule (FIPS 197 §5.2) ===
96func _aes_rcon(i: i64) -> i64 {
97 if i == 1 { return 0x01 } if i == 2 { return 0x02 } if i == 3 { return 0x04 } if i == 4 { return 0x08 }
98 if i == 5 { return 0x10 } if i == 6 { return 0x20 } if i == 7 { return 0x40 } if i == 8 { return 0x80 }
99 if i == 9 { return 0x1b }
100 return 0x36
101}
102
103// === GF(2^8) multiplication for MixColumns (xtime-based) ===
104// Multiply a by 2 in GF(2^8) with reduction polynomial x^8 + x^4 + x^3 + x + 1 (0x1b).
105func _xtime(a: i64) -> i64 {
106 let shifted: i64 = (a << 1) & 0xff
107 if (a & 0x80) != 0 { return shifted ^ 0x1b }
108 return shifted
109}
110
111// === Key expansion: derive 11 round keys (44 4-byte words) ===
112// Stored in scratch as 176 contiguous bytes, 16 bytes per round key.
113func _aes128_key_expand(key: *u8, rk: *u8) -> i64 {
114 var i: i64 = 0
115 while i < 16 { rk[i] = key[i]; i = i + 1 }
116 var n: i64 = 16 // bytes generated so far
117 var rcon_idx: i64 = 1
118 while n < 176 {
119 // last word
120 var t0: i64 = rk[n - 4]
121 var t1: i64 = rk[n - 3]
122 var t2: i64 = rk[n - 2]
123 var t3: i64 = rk[n - 1]
124 if (n & 15) == 0 {
125 // RotWord + SubBytes + Rcon
126 let r0: i64 = _aes_sbox(t1) ^ _aes_rcon(rcon_idx)
127 let r1: i64 = _aes_sbox(t2)
128 let r2: i64 = _aes_sbox(t3)
129 let r3: i64 = _aes_sbox(t0)
130 t0 = r0; t1 = r1; t2 = r2; t3 = r3
131 rcon_idx = rcon_idx + 1
132 }
133 rk[n] = (rk[n - 16] ^ t0) & 0xff
134 rk[n + 1] = (rk[n - 15] ^ t1) & 0xff
135 rk[n + 2] = (rk[n - 14] ^ t2) & 0xff
136 rk[n + 3] = (rk[n - 13] ^ t3) & 0xff
137 n = n + 4
138 }
139 return 0
140}
141
142// === AES round transformations ===
143
144// AddRoundKey: state ^= round_key (16 bytes XOR).
145func _aes_add_round_key(state: *u8, rk: *u8, round: i64) -> i64 {
146 var i: i64 = 0
147 while i < 16 { state[i] = (state[i] ^ rk[round * 16 + i]) & 0xff; i = i + 1 }
148 return 0
149}
150
151// SubBytes: state[i] = SBox[state[i]]
152func _aes_sub_bytes(state: *u8) -> i64 {
153 var i: i64 = 0
154 while i < 16 { state[i] = _aes_sbox(state[i]) & 0xff; i = i + 1 }
155 return 0
156}
157
158// ShiftRows: row r shifts left by r positions (cyclic).
159// State layout (column-major per FIPS 197):
160// state[0] state[4] state[8] state[12] <- row 0 (no shift)
161// state[1] state[5] state[9] state[13] <- row 1 (shift 1)
162// state[2] state[6] state[10] state[14] <- row 2 (shift 2)
163// state[3] state[7] state[11] state[15] <- row 3 (shift 3)
164func _aes_shift_rows(state: *u8) -> i64 {
165 // Row 1: rotate left by 1
166 let t1: i64 = state[1]
167 state[1] = state[5]
168 state[5] = state[9]
169 state[9] = state[13]
170 state[13] = t1
171 // Row 2: rotate left by 2 (swap pairs)
172 let t2: i64 = state[2]
173 state[2] = state[10]
174 state[10] = t2
175 let t6: i64 = state[6]
176 state[6] = state[14]
177 state[14] = t6
178 // Row 3: rotate left by 3 (= rotate right by 1)
179 let t3: i64 = state[15]
180 state[15] = state[11]
181 state[11] = state[7]
182 state[7] = state[3]
183 state[3] = t3
184 return 0
185}
186
187// MixColumns: for each 4-byte column, multiply by the matrix
188// [02 03 01 01]
189// [01 02 03 01]
190// [01 01 02 03]
191// [03 01 01 02]
192// in GF(2^8).
193func _aes_mix_columns(state: *u8) -> i64 {
194 var c: i64 = 0
195 while c < 4 {
196 let off: i64 = c * 4
197 let a0: i64 = state[off]
198 let a1: i64 = state[off + 1]
199 let a2: i64 = state[off + 2]
200 let a3: i64 = state[off + 3]
201 // t = a0 ^ a1 ^ a2 ^ a3
202 let t: i64 = a0 ^ a1 ^ a2 ^ a3
203 let n0: i64 = a0 ^ _xtime(a0 ^ a1) ^ t
204 let n1: i64 = a1 ^ _xtime(a1 ^ a2) ^ t
205 let n2: i64 = a2 ^ _xtime(a2 ^ a3) ^ t
206 let n3: i64 = a3 ^ _xtime(a3 ^ a0) ^ t
207 state[off] = n0 & 0xff
208 state[off + 1] = n1 & 0xff
209 state[off + 2] = n2 & 0xff
210 state[off + 3] = n3 & 0xff
211 c = c + 1
212 }
213 return 0
214}
215
216// === AES-128 encrypt one block ===
217func nx_aes128_encrypt(key_ptr: *u8, in_block: *u8,
218 scratch_ptr: *u8, out_block: *u8) -> i64 {
219 let rk: *u8 = scratch_ptr // 176 bytes for round keys
220 let state: *u8 = (scratch_ptr as i64 + 176) as *u8 // 16 bytes state
221 _aes128_key_expand(key_ptr, rk)
222 var i: i64 = 0
223 while i < 16 { state[i] = in_block[i]; i = i + 1 }
224 _aes_add_round_key(state, rk, 0)
225 var r: i64 = 1
226 while r < 10 {
227 _aes_sub_bytes(state)
228 _aes_shift_rows(state)
229 _aes_mix_columns(state)
230 _aes_add_round_key(state, rk, r)
231 r = r + 1
232 }
233 // Final round: no MixColumns
234 _aes_sub_bytes(state)
235 _aes_shift_rows(state)
236 _aes_add_round_key(state, rk, 10)
237 var j: i64 = 0
238 while j < 16 { out_block[j] = state[j]; j = j + 1 }
239 return 0
240}