1 ######################################################################
2 ## Constant-time SSSE3 AES core implementation.
5 ## By Mike Hamburg (Stanford University), 2009
8 ## For details see http://shiftleft.org/papers/vector_aes/ and
9 ## http://crypto.stanford.edu/vpaes/.
11 # *** This file is auto-generated ***
17 .long 218628480,235210255,168496130,67568393
18 .long 252381056,17041926,33884169,51187212
19 .long 252645135,252645135,252645135,252645135
20 .long 1512730624,3266504856,1377990664,3401244816
21 .long 830229760,1275146365,2969422977,3447763452
22 .long 3411033600,2979783055,338359620,2782886510
23 .long 4209124096,907596821,221174255,1006095553
24 .long 191964160,3799684038,3164090317,1589111125
25 .long 182528256,1777043520,2877432650,3265356744
26 .long 1874708224,3503451415,3305285752,363511674
27 .long 1606117888,3487855781,1093350906,2384367825
28 .long 197121,67569157,134941193,202313229
29 .long 67569157,134941193,202313229,197121
30 .long 134941193,202313229,197121,67569157
31 .long 202313229,197121,67569157,134941193
32 .long 33619971,100992007,168364043,235736079
33 .long 235736079,33619971,100992007,168364043
34 .long 168364043,235736079,33619971,100992007
35 .long 100992007,168364043,235736079,33619971
36 .long 50462976,117835012,185207048,252579084
37 .long 252314880,51251460,117574920,184942860
38 .long 184682752,252054788,50987272,118359308
39 .long 118099200,185467140,251790600,50727180
40 .long 2946363062,528716217,1300004225,1881839624
41 .long 1532713819,1532713819,1532713819,1532713819
42 .long 3602276352,4288629033,3737020424,4153884961
43 .long 1354558464,32357713,2958822624,3775749553
44 .long 1201988352,132424512,1572796698,503232858
45 .long 2213177600,1597421020,4103937655,675398315
46 .long 2749646592,4273543773,1511898873,121693092
47 .long 3040248576,1103263732,2871565598,1608280554
48 .long 2236667136,2588920351,482954393,64377734
49 .long 3069987328,291237287,2117370568,3650299247
50 .long 533321216,3573750986,2572112006,1401264716
51 .long 1339849704,2721158661,548607111,3445553514
52 .long 2128193280,3054596040,2183486460,1257083700
53 .long 655635200,1165381986,3923443150,2344132524
54 .long 190078720,256924420,290342170,357187870
55 .long 1610966272,2263057382,4103205268,309794674
56 .long 2592527872,2233205587,1335446729,3402964816
57 .long 3973531904,3225098121,3002836325,1918774430
58 .long 3870401024,2102906079,2284471353,4117666579
59 .long 617007872,1021508343,366931923,691083277
60 .long 2528395776,3491914898,2968704004,1613121270
61 .long 3445188352,3247741094,844474987,4093578302
62 .long 651481088,1190302358,1689581232,574775300
63 .long 4289380608,206939853,2555985458,2489840491
64 .long 2130264064,327674451,3566485037,3349835193
65 .long 2470714624,316102159,3636825756,3393945945
66 .byte 86,101,99,116,111,114,32,80,101,114,109,117,116,97,116,105
67 .byte 111,110,32,65,69,83,32,102,111,114,32,120,56,54,47,83
68 .byte 83,83,69,51,44,32,77,105,107,101,32,72,97,109,98,117
69 .byte 114,103,32,40,83,116,97,110,102,111,114,100,32,85,110,105
70 .byte 118,101,114,115,105,116,121,41,0
72 .def __vpaes_preheat; .scl 3; .type 32; .endef
76 movdqa -48(%ebp),%xmm7
77 movdqa -16(%ebp),%xmm6
79 .def __vpaes_encrypt_core; .scl 3; .type 32; .endef
100 movdqa 32(%ebp),%xmm4
101 movdqa 48(%ebp),%xmm0
102 .byte 102,15,56,0,226
103 .byte 102,15,56,0,195
105 movdqa 64(%ebp),%xmm5
107 movdqa -64(%ebx,%ecx,1),%xmm1
108 .byte 102,15,56,0,234
109 movdqa 80(%ebp),%xmm2
110 movdqa (%ebx,%ecx,1),%xmm4
111 .byte 102,15,56,0,211
114 .byte 102,15,56,0,193
117 .byte 102,15,56,0,220
120 .byte 102,15,56,0,193
126 movdqa -32(%ebp),%xmm5
130 .byte 102,15,56,0,232
133 .byte 102,15,56,0,217
136 .byte 102,15,56,0,224
139 .byte 102,15,56,0,211
142 .byte 102,15,56,0,220
146 movdqa 96(%ebp),%xmm4
147 movdqa 112(%ebp),%xmm0
148 .byte 102,15,56,0,226
150 .byte 102,15,56,0,195
151 movdqa 64(%ebx,%ecx,1),%xmm1
153 .byte 102,15,56,0,193
155 .def __vpaes_decrypt_core; .scl 3; .type 32; .endef
157 __vpaes_decrypt_core:
161 movdqa -64(%ebx),%xmm2
168 .byte 102,15,56,0,208
169 movdqa -48(%ebx),%xmm0
171 .byte 102,15,56,0,193
174 movdqa 176(%ebp),%xmm5
177 leal -352(%ebx,%ecx,1),%ecx
181 movdqa -32(%ebx),%xmm4
182 movdqa -16(%ebx),%xmm1
183 .byte 102,15,56,0,226
184 .byte 102,15,56,0,203
188 movdqa 16(%ebx),%xmm1
189 .byte 102,15,56,0,226
190 .byte 102,15,56,0,197
191 .byte 102,15,56,0,203
193 movdqa 32(%ebx),%xmm4
195 movdqa 48(%ebx),%xmm1
196 .byte 102,15,56,0,226
197 .byte 102,15,56,0,197
198 .byte 102,15,56,0,203
200 movdqa 64(%ebx),%xmm4
202 movdqa 80(%ebx),%xmm1
203 .byte 102,15,56,0,226
204 .byte 102,15,56,0,197
205 .byte 102,15,56,0,203
208 .byte 102,15,58,15,237,12
213 movdqa -32(%ebp),%xmm2
217 .byte 102,15,56,0,208
220 .byte 102,15,56,0,217
223 .byte 102,15,56,0,224
226 .byte 102,15,56,0,211
229 .byte 102,15,56,0,220
233 movdqa 96(%ebx),%xmm4
234 .byte 102,15,56,0,226
236 movdqa 112(%ebx),%xmm0
238 .byte 102,15,56,0,195
240 .byte 102,15,56,0,194
242 .def __vpaes_schedule_core; .scl 3; .type 32; .endef
244 __vpaes_schedule_core:
247 movdqa 320(%ebp),%xmm2
251 call __vpaes_schedule_transform
254 jnz .L004schedule_am_decrypting
257 .L004schedule_am_decrypting:
258 movdqa 256(%ebp,%ecx,1),%xmm1
259 .byte 102,15,56,0,217
268 .L009loop_schedule_128:
269 call __vpaes_schedule_round
271 jz .L010schedule_mangle_last
272 call __vpaes_schedule_mangle
273 jmp .L009loop_schedule_128
277 call __vpaes_schedule_transform
282 .L011loop_schedule_192:
283 call __vpaes_schedule_round
284 .byte 102,15,58,15,198,8
285 call __vpaes_schedule_mangle
286 call __vpaes_schedule_192_smear
287 call __vpaes_schedule_mangle
288 call __vpaes_schedule_round
290 jz .L010schedule_mangle_last
291 call __vpaes_schedule_mangle
292 call __vpaes_schedule_192_smear
293 jmp .L011loop_schedule_192
296 movdqu 16(%esi),%xmm0
297 call __vpaes_schedule_transform
299 .L012loop_schedule_256:
300 call __vpaes_schedule_mangle
302 call __vpaes_schedule_round
304 jz .L010schedule_mangle_last
305 call __vpaes_schedule_mangle
306 pshufd $255,%xmm0,%xmm0
307 movdqa %xmm7,20(%esp)
309 call .L_vpaes_schedule_low_round
310 movdqa 20(%esp),%xmm7
311 jmp .L012loop_schedule_256
313 .L010schedule_mangle_last:
316 jnz .L013schedule_mangle_last_dec
317 movdqa 256(%ebp,%ecx,1),%xmm1
318 .byte 102,15,56,0,193
321 .L013schedule_mangle_last_dec:
324 call __vpaes_schedule_transform
335 .def __vpaes_schedule_192_smear; .scl 3; .type 32; .endef
337 __vpaes_schedule_192_smear:
338 pshufd $128,%xmm6,%xmm1
339 pshufd $254,%xmm7,%xmm0
346 .def __vpaes_schedule_round; .scl 3; .type 32; .endef
348 __vpaes_schedule_round:
351 .byte 102,15,58,15,202,15
352 .byte 102,15,58,15,210,15
354 pshufd $255,%xmm0,%xmm0
355 .byte 102,15,58,15,192,1
357 .L_vpaes_schedule_low_round:
365 movdqa -16(%ebp),%xmm4
366 movdqa -48(%ebp),%xmm5
371 movdqa -32(%ebp),%xmm2
372 .byte 102,15,56,0,208
375 .byte 102,15,56,0,217
378 .byte 102,15,56,0,224
381 .byte 102,15,56,0,211
384 .byte 102,15,56,0,220
386 movdqa 32(%ebp),%xmm4
387 .byte 102,15,56,0,226
388 movdqa 48(%ebp),%xmm0
389 .byte 102,15,56,0,195
394 .def __vpaes_schedule_transform; .scl 3; .type 32; .endef
396 __vpaes_schedule_transform:
397 movdqa -16(%ebp),%xmm2
403 .byte 102,15,56,0,208
404 movdqa 16(%ebx),%xmm0
405 .byte 102,15,56,0,193
408 .def __vpaes_schedule_mangle; .scl 3; .type 32; .endef
410 __vpaes_schedule_mangle:
412 movdqa 128(%ebp),%xmm5
414 jnz .L014schedule_mangle_dec
417 .byte 102,15,56,0,229
419 .byte 102,15,56,0,229
421 .byte 102,15,56,0,229
423 jmp .L015schedule_mangle_both
425 .L014schedule_mangle_dec:
426 movdqa -16(%ebp),%xmm2
433 .byte 102,15,56,0,212
434 movdqa 16(%esi),%xmm3
435 .byte 102,15,56,0,217
437 .byte 102,15,56,0,221
438 movdqa 32(%esi),%xmm2
439 .byte 102,15,56,0,212
441 movdqa 48(%esi),%xmm3
442 .byte 102,15,56,0,217
444 .byte 102,15,56,0,221
445 movdqa 64(%esi),%xmm2
446 .byte 102,15,56,0,212
448 movdqa 80(%esi),%xmm3
449 .byte 102,15,56,0,217
451 .byte 102,15,56,0,221
452 movdqa 96(%esi),%xmm2
453 .byte 102,15,56,0,212
455 movdqa 112(%esi),%xmm3
456 .byte 102,15,56,0,217
459 .L015schedule_mangle_both:
460 movdqa 256(%ebp,%ecx,1),%xmm1
461 .byte 102,15,56,0,217
466 .globl _vpaes_set_encrypt_key
467 .def _vpaes_set_encrypt_key; .scl 2; .type 32; .endef
469 _vpaes_set_encrypt_key:
470 .L_vpaes_set_encrypt_key_begin:
488 leal .L_vpaes_consts+0x30-.L016pic_point,%ebp
489 call __vpaes_schedule_core
498 .globl _vpaes_set_decrypt_key
499 .def _vpaes_set_decrypt_key; .scl 2; .type 32; .endef
501 _vpaes_set_decrypt_key:
502 .L_vpaes_set_decrypt_key_begin:
519 leal 16(%edx,%ebx,1),%edx
525 leal .L_vpaes_consts+0x30-.L017pic_point,%ebp
526 call __vpaes_schedule_core
535 .globl _vpaes_encrypt
536 .def _vpaes_encrypt; .scl 2; .type 32; .endef
539 .L_vpaes_encrypt_begin:
544 leal .L_vpaes_consts+0x30-.L018pic_point,%ebp
555 call __vpaes_encrypt_core
563 .globl _vpaes_decrypt
564 .def _vpaes_decrypt; .scl 2; .type 32; .endef
567 .L_vpaes_decrypt_begin:
572 leal .L_vpaes_consts+0x30-.L019pic_point,%ebp
583 call __vpaes_decrypt_core
591 .globl _vpaes_cbc_encrypt
592 .def _vpaes_cbc_encrypt; .scl 2; .type 32; .endef
595 .L_vpaes_cbc_encrypt_begin:
618 leal .L_vpaes_consts+0x30-.L021pic_point,%ebp
623 jmp .L023cbc_enc_loop
628 call __vpaes_encrypt_core
632 movdqu %xmm0,(%ebx,%esi,1)
635 jnc .L023cbc_enc_loop
640 movdqa %xmm1,16(%esp)
641 movdqa %xmm0,32(%esp)
642 call __vpaes_decrypt_core
646 movdqa 32(%esp),%xmm1
647 movdqu %xmm0,(%ebx,%esi,1)
650 jnc .L022cbc_dec_loop
662 .section .note.GNU-stack,"",%progbits