aes128.py
1 # MIT License 2 3 # Copyright (c) 2021 Or Gur Arie 4 5 # Permission is hereby granted, free of charge, to any person obtaining a copy 6 # of this software and associated documentation files (the "Software"), to deal 7 # in the Software without restriction, including without limitation the rights 8 # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 # copies of the Software, and to permit persons to whom the Software is 10 # furnished to do so, subject to the following conditions: 11 12 # The above copyright notice and this permission notice shall be included in all 13 # copies or substantial portions of the Software. 14 15 # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 # SOFTWARE. 22 23 ## AES lookup tables 24 # resource: https://en.wikipedia.org/wiki/Rijndael_S-box 25 s_box = ( 26 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 27 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 28 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 29 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 30 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 31 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 32 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 33 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 34 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 35 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 36 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 37 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 38 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 39 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 40 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 41 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16, 42 ) 43 44 inv_s_box = ( 45 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 46 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 47 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 48 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 49 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 50 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 51 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 52 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 53 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 54 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 55 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 56 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 57 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 58 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 59 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 60 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D, 61 ) 62 63 64 ## AES AddRoundKey 65 # Round constants https://en.wikipedia.org/wiki/AES_key_schedule#Round_constants 66 r_con = ( 67 0x00, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 68 0x80, 0x1B, 0x36, 0x6C, 0xD8, 0xAB, 0x4D, 0x9A, 69 0x2F, 0x5E, 0xBC, 0x63, 0xC6, 0x97, 0x35, 0x6A, 70 0xD4, 0xB3, 0x7D, 0xFA, 0xEF, 0xC5, 0x91, 0x39, 71 ) 72 73 def add_round_key(s, k): 74 for i in range(4): 75 for j in range(4): 76 s[i][j] ^= k[i][j] 77 78 79 ## AES SubBytes 80 def sub_bytes(s): 81 for i in range(4): 82 for j in range(4): 83 s[i][j] = s_box[s[i][j]] 84 85 86 def inv_sub_bytes(s): 87 for i in range(4): 88 for j in range(4): 89 s[i][j] = inv_s_box[s[i][j]] 90 91 92 ## AES ShiftRows 93 def shift_rows(s): 94 s[0][1], s[1][1], s[2][1], s[3][1] = s[1][1], s[2][1], s[3][1], s[0][1] 95 s[0][2], s[1][2], s[2][2], s[3][2] = s[2][2], s[3][2], s[0][2], s[1][2] 96 s[0][3], s[1][3], s[2][3], s[3][3] = s[3][3], s[0][3], s[1][3], s[2][3] 97 98 99 def inv_shift_rows(s): 100 s[0][1], s[1][1], s[2][1], s[3][1] = s[3][1], s[0][1], s[1][1], s[2][1] 101 s[0][2], s[1][2], s[2][2], s[3][2] = s[2][2], s[3][2], s[0][2], s[1][2] 102 s[0][3], s[1][3], s[2][3], s[3][3] = s[1][3], s[2][3], s[3][3], s[0][3] 103 104 105 ## AES MixColumns 106 # learned from http://cs.ucsb.edu/~koc/cs178/projects/JT/aes.c 107 xtime = lambda a: (((a << 1) ^ 0x1B) & 0xFF) if (a & 0x80) else (a << 1) 108 109 110 def mix_single_column(a): 111 # see Sec 4.1.2 in The Design of Rijndael 112 t = a[0] ^ a[1] ^ a[2] ^ a[3] 113 u = a[0] 114 a[0] ^= t ^ xtime(a[0] ^ a[1]) 115 a[1] ^= t ^ xtime(a[1] ^ a[2]) 116 a[2] ^= t ^ xtime(a[2] ^ a[3]) 117 a[3] ^= t ^ xtime(a[3] ^ u) 118 119 120 def mix_columns(s): 121 for i in range(4): 122 mix_single_column(s[i]) 123 124 125 def inv_mix_columns(s): 126 # see Sec 4.1.3 in The Design of Rijndael 127 for i in range(4): 128 u = xtime(xtime(s[i][0] ^ s[i][2])) 129 v = xtime(xtime(s[i][1] ^ s[i][3])) 130 s[i][0] ^= u 131 s[i][1] ^= v 132 s[i][2] ^= u 133 s[i][3] ^= v 134 135 mix_columns(s) 136 137 ## AES Bytes 138 def bytes2matrix(text): 139 """ Converts a 16-byte array into a 4x4 matrix. """ 140 return [list(text[i:i+4]) for i in range(0, len(text), 4)] 141 142 def matrix2bytes(matrix): 143 """ Converts a 4x4 matrix into a 16-byte array. """ 144 return bytes(sum(matrix, [])) 145 146 147 def xor_bytes(a, b): 148 """ Returns a new byte array with the elements xor'ed. """ 149 return bytes(i^j for i, j in zip(a, b)) 150 151 152 def split_blocks(message, block_size=16, require_padding=True): 153 assert len(message) % block_size == 0 or not require_padding 154 return [message[i:i+16] for i in range(0, len(message), block_size)] 155 156 class AES128: 157 # AES-128 block size 158 block_size = 16 159 # AES-128 encrypts messages with 10 rounds 160 _rounds = 10 161 162 163 # initiate the AES objecy 164 def __init__(self, key): 165 """ 166 Initializes the object with a given key. 167 """ 168 # make sure key length is right 169 assert len(key) == AES128.block_size 170 171 # ExpandKey 172 self._round_keys = self._expand_key(key) 173 174 175 # will perform the AES ExpandKey phase 176 def _expand_key(self, master_key): 177 """ 178 Expands and returns a list of key matrices for the given master_key. 179 """ 180 181 # Initialize round keys with raw key material. 182 key_columns = bytes2matrix(master_key) 183 iteration_size = len(master_key) // 4 184 185 # Each iteration has exactly as many columns as the key material. 186 i = 1 187 while len(key_columns) < (self._rounds + 1) * 4: 188 # Copy previous word. 189 word = list(key_columns[-1]) 190 191 # Perform schedule_core once every "row". 192 if len(key_columns) % iteration_size == 0: 193 # Circular shift. 194 word.append(word.pop(0)) 195 # Map to S-BOX. 196 word = [s_box[b] for b in word] 197 # XOR with first byte of R-CON, since the others bytes of R-CON are 0. 198 word[0] ^= r_con[i] 199 i += 1 200 elif len(master_key) == 32 and len(key_columns) % iteration_size == 4: 201 # Run word through S-box in the fourth iteration when using a 202 # 256-bit key. 203 word = [s_box[b] for b in word] 204 205 # XOR with equivalent word from previous iteration. 206 word = bytes(i^j for i, j in zip(word, key_columns[-iteration_size])) 207 key_columns.append(word) 208 209 # Group key words in 4x4 byte matrices. 210 return [key_columns[4*i : 4*(i+1)] for i in range(len(key_columns) // 4)] 211 212 213 # encrypt a single block of data with AES 214 def _encrypt_block(self, plaintext): 215 """ 216 Encrypts a single block of 16 byte long plaintext. 217 """ 218 # length of a single block 219 assert len(plaintext) == AES128.block_size 220 221 # perform on a matrix 222 state = bytes2matrix(plaintext) 223 224 # AddRoundKey 225 add_round_key(state, self._round_keys[0]) 226 227 # 9 main rounds 228 for i in range(1, self._rounds): 229 # SubBytes 230 sub_bytes(state) 231 # ShiftRows 232 shift_rows(state) 233 # MixCols 234 mix_columns(state) 235 # AddRoundKey 236 add_round_key(state, self._round_keys[i]) 237 238 # last round, w/t AddRoundKey step 239 sub_bytes(state) 240 shift_rows(state) 241 add_round_key(state, self._round_keys[-1]) 242 243 # return the encrypted matrix as bytes 244 return matrix2bytes(state) 245 246 247 # decrypt a single block of data with AES 248 def _decrypt_block(self, ciphertext): 249 """ 250 Decrypts a single block of 16 byte long ciphertext. 251 """ 252 # length of a single block 253 assert len(ciphertext) == AES128.block_size 254 255 # perform on a matrix 256 state = bytes2matrix(ciphertext) 257 258 # in reverse order, last round is first 259 add_round_key(state, self._round_keys[-1]) 260 inv_shift_rows(state) 261 inv_sub_bytes(state) 262 263 for i in range(self._rounds - 1, 0, -1): 264 # nain rounds 265 add_round_key(state, self._round_keys[i]) 266 inv_mix_columns(state) 267 inv_shift_rows(state) 268 inv_sub_bytes(state) 269 270 # initial AddRoundKey phase 271 add_round_key(state, self._round_keys[0]) 272 273 # return bytes 274 return matrix2bytes(state) 275 276 277 # will encrypt the entire data 278 def encrypt(self, plaintext, iv): 279 """ 280 Encrypts `plaintext` using CBC mode and PKCS#7 padding, with the given 281 initialization vector (iv). 282 """ 283 # iv length must be same as block size 284 assert len(iv) == AES128.block_size 285 286 assert len(plaintext) % AES128.block_size == 0 287 288 ciphertext_blocks = [] 289 290 previous = iv 291 for plaintext_block in split_blocks(plaintext): 292 # in CBC mode every block is XOR'd with the previous block 293 xorred = xor_bytes(plaintext_block, previous) 294 295 # encrypt current block 296 block = self._encrypt_block(xorred) 297 previous = block 298 299 # append to ciphertext 300 ciphertext_blocks.append(block) 301 302 # return as bytes 303 return b''.join(ciphertext_blocks) 304 305 306 # will decrypt the entire data 307 def decrypt(self, ciphertext, iv): 308 """ 309 Decrypts `ciphertext` using CBC mode and PKCS#7 padding, with the given 310 initialization vector (iv). 311 """ 312 # iv length must be same as block size 313 assert len(iv) == AES128.block_size 314 315 plaintext_blocks = [] 316 317 previous = iv 318 for ciphertext_block in split_blocks(ciphertext): 319 # in CBC mode every block is XOR'd with the previous block 320 xorred = xor_bytes(previous, self._decrypt_block(ciphertext_block)) 321 322 # append plaintext 323 plaintext_blocks.append(xorred) 324 previous = ciphertext_block 325 326 return b''.join(plaintext_blocks)