PageRenderTime 37ms CodeModel.GetById 15ms RepoModel.GetById 0ms app.codeStats 0ms

/phpseclib/Crypt/AES.php

https://github.com/kea/phpseclib
PHP | 606 lines | 280 code | 60 blank | 266 comment | 45 complexity | 94d7ca70cea3f2a7fb6595e497a01e90 MD5 | raw file
  1. <?php
  2. /* vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4: */
  3. /**
  4. * Pure-PHP implementation of AES.
  5. *
  6. * Uses mcrypt, if available, and an internal implementation, otherwise.
  7. *
  8. * PHP versions 4 and 5
  9. *
  10. * If {@link Crypt_AES::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
  11. * {@link Crypt_AES::setKey() setKey()}. ie. if the key is 128-bits, the key length will be 128-bits. If it's 136-bits
  12. * it'll be null-padded to 160-bits and 160 bits will be the key length until {@link Crypt_Rijndael::setKey() setKey()}
  13. * is called, again, at which point, it'll be recalculated.
  14. *
  15. * Since Crypt_AES extends Crypt_Rijndael, some functions are available to be called that, in the context of AES, don't
  16. * make a whole lot of sense. {@link Crypt_AES::setBlockLength() setBlockLength()}, for instance. Calling that function,
  17. * however possible, won't do anything (AES has a fixed block length whereas Rijndael has a variable one).
  18. *
  19. * Here's a short example of how to use this library:
  20. * <code>
  21. * <?php
  22. * include('Crypt/AES.php');
  23. *
  24. * $aes = new Crypt_AES();
  25. *
  26. * $aes->setKey('abcdefghijklmnop');
  27. *
  28. * $size = 10 * 1024;
  29. * $plaintext = '';
  30. * for ($i = 0; $i < $size; $i++) {
  31. * $plaintext.= 'a';
  32. * }
  33. *
  34. * echo $aes->decrypt($aes->encrypt($plaintext));
  35. * ?>
  36. * </code>
  37. *
  38. * LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy
  39. * of this software and associated documentation files (the "Software"), to deal
  40. * in the Software without restriction, including without limitation the rights
  41. * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  42. * copies of the Software, and to permit persons to whom the Software is
  43. * furnished to do so, subject to the following conditions:
  44. *
  45. * The above copyright notice and this permission notice shall be included in
  46. * all copies or substantial portions of the Software.
  47. *
  48. * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  49. * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  50. * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
  51. * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  52. * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  53. * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  54. * THE SOFTWARE.
  55. *
  56. * @category Crypt
  57. * @package Crypt_AES
  58. * @author Jim Wigginton <terrafrost@php.net>
  59. * @copyright MMVIII Jim Wigginton
  60. * @license http://www.opensource.org/licenses/mit-license.html MIT License
  61. * @version $Id: AES.php,v 1.7 2010/02/09 06:10:25 terrafrost Exp $
  62. * @link http://phpseclib.sourceforge.net
  63. */
  64. namespace phpseclib;
  65. /**
  66. * Pure-PHP implementation of AES.
  67. *
  68. * @author Jim Wigginton <terrafrost@php.net>
  69. * @version 0.1.0
  70. * @access public
  71. * @package Crypt_AES
  72. */
  73. class Crypt_AES extends Crypt_Rijndael {
  74. /**#@+
  75. * @access public
  76. * @see Crypt_AES::encrypt()
  77. * @see Crypt_AES::decrypt()
  78. */
  79. /**
  80. * Encrypt / decrypt using the Counter mode.
  81. *
  82. * Set to -1 since that's what Crypt/Random.php uses to index the CTR mode.
  83. *
  84. * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Counter_.28CTR.29
  85. */
  86. const MODE_CTR = -1;
  87. /**
  88. * Encrypt / decrypt using the Electronic Code Book mode.
  89. *
  90. * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Electronic_codebook_.28ECB.29
  91. */
  92. const MODE_ECB = 1;
  93. /**
  94. * Encrypt / decrypt using the Code Book Chaining mode.
  95. *
  96. * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher-block_chaining_.28CBC.29
  97. */
  98. const MODE_CBC = 2;
  99. /**
  100. * Encrypt / decrypt using the Cipher Feedback mode.
  101. *
  102. * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher_feedback_.28CFB.29
  103. */
  104. const MODE_CFB = 3;
  105. /**
  106. * Encrypt / decrypt using the Cipher Feedback mode.
  107. *
  108. * @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Output_feedback_.28OFB.29
  109. */
  110. const MODE_OFB = 4;
  111. /**#@-*/
  112. /**#@+
  113. * @access private
  114. * @see Crypt_AES::Crypt_AES()
  115. */
  116. /**
  117. * Toggles the internal implementation
  118. */
  119. const MODE_INTERNAL = 1;
  120. /**
  121. * Toggles the mcrypt implementation
  122. */
  123. const MODE_MCRYPT = 2;
  124. /**#@-*/
  125. /**
  126. * mcrypt resource for encryption
  127. *
  128. * The mcrypt resource can be recreated every time something needs to be created or it can be created just once.
  129. * Since mcrypt operates in continuous mode, by default, it'll need to be recreated when in non-continuous mode.
  130. *
  131. * @see Crypt_AES::encrypt()
  132. * @var String
  133. * @access private
  134. */
  135. var $enmcrypt;
  136. /**
  137. * mcrypt resource for decryption
  138. *
  139. * The mcrypt resource can be recreated every time something needs to be created or it can be created just once.
  140. * Since mcrypt operates in continuous mode, by default, it'll need to be recreated when in non-continuous mode.
  141. *
  142. * @see Crypt_AES::decrypt()
  143. * @var String
  144. * @access private
  145. */
  146. var $demcrypt;
  147. /**
  148. * mcrypt resource for CFB mode
  149. *
  150. * @see Crypt_AES::encrypt()
  151. * @see Crypt_AES::decrypt()
  152. * @var String
  153. * @access private
  154. */
  155. var $ecb;
  156. /**
  157. * Default Constructor.
  158. *
  159. * Determines whether or not the mcrypt extension should be used. $mode should only, at present, be
  160. * self::MODE_ECB or self::MODE_CBC. If not explictly set, self::MODE_CBC will be used.
  161. *
  162. * @param optional Integer $mode
  163. * @return Crypt_AES
  164. * @access public
  165. */
  166. function __construct($mode = self::MODE_CBC)
  167. {
  168. if ( !defined('CRYPT_AES_MODE') ) {
  169. switch (true) {
  170. case extension_loaded('mcrypt') && in_array('rijndael-128', mcrypt_list_algorithms()):
  171. define('CRYPT_AES_MODE', self::MODE_MCRYPT);
  172. break;
  173. default:
  174. define('CRYPT_AES_MODE', self::MODE_INTERNAL);
  175. }
  176. }
  177. switch ( CRYPT_AES_MODE ) {
  178. case self::MODE_MCRYPT:
  179. switch ($mode) {
  180. case self::MODE_ECB:
  181. $this->paddable = true;
  182. $this->mode = MCRYPT_MODE_ECB;
  183. break;
  184. case self::MODE_CTR:
  185. // ctr doesn't have a constant associated with it even though it appears to be fairly widely
  186. // supported. in lieu of knowing just how widely supported it is, i've, for now, opted not to
  187. // include a compatibility layer. the layer has been implemented but, for now, is commented out.
  188. $this->mode = 'ctr';
  189. //$this->mode = in_array('ctr', mcrypt_list_modes()) ? 'ctr' : self::MODE_CTR;
  190. break;
  191. case self::MODE_CFB:
  192. $this->mode = 'ncfb';
  193. break;
  194. case self::MODE_OFB:
  195. $this->mode = MCRYPT_MODE_NOFB;
  196. break;
  197. case self::MODE_CBC:
  198. default:
  199. $this->paddable = true;
  200. $this->mode = MCRYPT_MODE_CBC;
  201. }
  202. $this->debuffer = $this->enbuffer = '';
  203. break;
  204. default:
  205. switch ($mode) {
  206. case self::MODE_ECB:
  207. $this->paddable = true;
  208. $this->mode = CRYPT_RIJNDAEL_MODE_ECB;
  209. break;
  210. case self::MODE_CTR:
  211. $this->mode = CRYPT_RIJNDAEL_MODE_CTR;
  212. break;
  213. case self::MODE_CFB:
  214. $this->mode = CRYPT_RIJNDAEL_MODE_CFB;
  215. break;
  216. case self::MODE_OFB:
  217. $this->mode = CRYPT_RIJNDAEL_MODE_OFB;
  218. break;
  219. case self::MODE_CBC:
  220. default:
  221. $this->paddable = true;
  222. $this->mode = CRYPT_RIJNDAEL_MODE_CBC;
  223. }
  224. }
  225. if (CRYPT_AES_MODE == self::MODE_INTERNAL) {
  226. parent::__construct($this->mode);
  227. }
  228. }
  229. /**
  230. * Dummy function
  231. *
  232. * Since Crypt_AES extends Crypt_Rijndael, this function is, technically, available, but it doesn't do anything.
  233. *
  234. * @access public
  235. * @param Integer $length
  236. */
  237. function setBlockLength($length)
  238. {
  239. return;
  240. }
  241. /**
  242. * Sets the initialization vector. (optional)
  243. *
  244. * SetIV is not required when CRYPT_RIJNDAEL_MODE_ECB is being used. If not explictly set, it'll be assumed
  245. * to be all zero's.
  246. *
  247. * @access public
  248. * @param String $iv
  249. */
  250. function setIV($iv)
  251. {
  252. parent::setIV($iv);
  253. if ( CRYPT_AES_MODE == self::MODE_MCRYPT ) {
  254. $this->changed = true;
  255. }
  256. }
  257. /**
  258. * Encrypts a message.
  259. *
  260. * $plaintext will be padded with up to 16 additional bytes. Other AES implementations may or may not pad in the
  261. * same manner. Other common approaches to padding and the reasons why it's necessary are discussed in the following
  262. * URL:
  263. *
  264. * {@link http://www.di-mgt.com.au/cryptopad.html http://www.di-mgt.com.au/cryptopad.html}
  265. *
  266. * An alternative to padding is to, separately, send the length of the file. This is what SSH, in fact, does.
  267. * strlen($plaintext) will still need to be a multiple of 16, however, arbitrary values can be added to make it that
  268. * length.
  269. *
  270. * @see Crypt_AES::decrypt()
  271. * @access public
  272. * @param String $plaintext
  273. */
  274. function encrypt($plaintext)
  275. {
  276. if ( CRYPT_AES_MODE == self::MODE_MCRYPT ) {
  277. $changed = $this->changed;
  278. $this->_mcryptSetup();
  279. /*
  280. if ($this->mode == self::MODE_CTR) {
  281. $iv = $this->encryptIV;
  282. $xor = mcrypt_generic($this->enmcrypt, $this->_generate_xor(strlen($plaintext), $iv));
  283. $ciphertext = $plaintext ^ $xor;
  284. if ($this->continuousBuffer) {
  285. $this->encryptIV = $iv;
  286. }
  287. return $ciphertext;
  288. }
  289. */
  290. // re: http://phpseclib.sourceforge.net/cfb-demo.phps
  291. // using mcrypt's default handing of CFB the above would output two different things. using phpseclib's
  292. // rewritten CFB implementation the above outputs the same thing twice.
  293. if ($this->mode == 'ncfb') {
  294. if ($changed) {
  295. $this->ecb = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_ECB, '');
  296. mcrypt_generic_init($this->ecb, $this->key, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
  297. }
  298. if (strlen($this->enbuffer)) {
  299. $ciphertext = $plaintext ^ substr($this->encryptIV, strlen($this->enbuffer));
  300. $this->enbuffer.= $ciphertext;
  301. if (strlen($this->enbuffer) == 16) {
  302. $this->encryptIV = $this->enbuffer;
  303. $this->enbuffer = '';
  304. mcrypt_generic_init($this->enmcrypt, $this->key, $this->encryptIV);
  305. }
  306. $plaintext = substr($plaintext, strlen($ciphertext));
  307. } else {
  308. $ciphertext = '';
  309. }
  310. $last_pos = strlen($plaintext) & 0xFFFFFFF0;
  311. $ciphertext.= $last_pos ? mcrypt_generic($this->enmcrypt, substr($plaintext, 0, $last_pos)) : '';
  312. if (strlen($plaintext) & 0xF) {
  313. if (strlen($ciphertext)) {
  314. $this->encryptIV = substr($ciphertext, -16);
  315. }
  316. $this->encryptIV = mcrypt_generic($this->ecb, $this->encryptIV);
  317. $this->enbuffer = substr($plaintext, $last_pos) ^ $this->encryptIV;
  318. $ciphertext.= $this->enbuffer;
  319. }
  320. return $ciphertext;
  321. }
  322. if ($this->paddable) {
  323. $plaintext = $this->_pad($plaintext);
  324. }
  325. $ciphertext = mcrypt_generic($this->enmcrypt, $plaintext);
  326. if (!$this->continuousBuffer) {
  327. mcrypt_generic_init($this->enmcrypt, $this->key, $this->iv);
  328. }
  329. return $ciphertext;
  330. }
  331. return parent::encrypt($plaintext);
  332. }
  333. /**
  334. * Decrypts a message.
  335. *
  336. * If strlen($ciphertext) is not a multiple of 16, null bytes will be added to the end of the string until it is.
  337. *
  338. * @see Crypt_AES::encrypt()
  339. * @access public
  340. * @param String $ciphertext
  341. */
  342. function decrypt($ciphertext)
  343. {
  344. if ( CRYPT_AES_MODE == self::MODE_MCRYPT ) {
  345. $changed = $this->changed;
  346. $this->_mcryptSetup();
  347. /*
  348. if ($this->mode == self::MODE_CTR) {
  349. $iv = $this->decryptIV;
  350. $xor = mcrypt_generic($this->enmcrypt, $this->_generate_xor(strlen($ciphertext), $iv));
  351. $plaintext = $ciphertext ^ $xor;
  352. if ($this->continuousBuffer) {
  353. $this->decryptIV = $iv;
  354. }
  355. return $plaintext;
  356. }
  357. */
  358. if ($this->mode == 'ncfb') {
  359. if ($changed) {
  360. $this->ecb = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', MCRYPT_MODE_ECB, '');
  361. mcrypt_generic_init($this->ecb, $this->key, "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0");
  362. }
  363. if (strlen($this->debuffer)) {
  364. $plaintext = $ciphertext ^ substr($this->decryptIV, strlen($this->debuffer));
  365. $this->debuffer.= substr($ciphertext, 0, strlen($plaintext));
  366. if (strlen($this->debuffer) == 16) {
  367. $this->decryptIV = $this->debuffer;
  368. $this->debuffer = '';
  369. mcrypt_generic_init($this->demcrypt, $this->key, $this->decryptIV);
  370. }
  371. $ciphertext = substr($ciphertext, strlen($plaintext));
  372. } else {
  373. $plaintext = '';
  374. }
  375. $last_pos = strlen($ciphertext) & 0xFFFFFFF0;
  376. $plaintext.= $last_pos ? mdecrypt_generic($this->demcrypt, substr($ciphertext, 0, $last_pos)) : '';
  377. if (strlen($ciphertext) & 0xF) {
  378. if (strlen($plaintext)) {
  379. $this->decryptIV = substr($ciphertext, $last_pos - 16, 16);
  380. }
  381. $this->decryptIV = mcrypt_generic($this->ecb, $this->decryptIV);
  382. $this->debuffer = substr($ciphertext, $last_pos);
  383. $plaintext.= $this->debuffer ^ $this->decryptIV;
  384. }
  385. return $plaintext;
  386. }
  387. if ($this->paddable) {
  388. // we pad with chr(0) since that's what mcrypt_generic does. to quote from http://php.net/function.mcrypt-generic :
  389. // "The data is padded with "\0" to make sure the length of the data is n * blocksize."
  390. $ciphertext = str_pad($ciphertext, (strlen($ciphertext) + 15) & 0xFFFFFFF0, chr(0));
  391. }
  392. $plaintext = mdecrypt_generic($this->demcrypt, $ciphertext);
  393. if (!$this->continuousBuffer) {
  394. mcrypt_generic_init($this->demcrypt, $this->key, $this->iv);
  395. }
  396. return $this->paddable ? $this->_unpad($plaintext) : $plaintext;
  397. }
  398. return parent::decrypt($ciphertext);
  399. }
  400. /**
  401. * Setup mcrypt
  402. *
  403. * Validates all the variables.
  404. *
  405. * @access private
  406. */
  407. function _mcryptSetup()
  408. {
  409. if (!$this->changed) {
  410. return;
  411. }
  412. if (!$this->explicit_key_length) {
  413. // this just copied from Crypt_Rijndael::_setup()
  414. $length = strlen($this->key) >> 2;
  415. if ($length > 8) {
  416. $length = 8;
  417. } else if ($length < 4) {
  418. $length = 4;
  419. }
  420. $this->Nk = $length;
  421. $this->key_size = $length << 2;
  422. }
  423. switch ($this->Nk) {
  424. case 4: // 128
  425. $this->key_size = 16;
  426. break;
  427. case 5: // 160
  428. case 6: // 192
  429. $this->key_size = 24;
  430. break;
  431. case 7: // 224
  432. case 8: // 256
  433. $this->key_size = 32;
  434. }
  435. $this->key = str_pad(substr($this->key, 0, $this->key_size), $this->key_size, chr(0));
  436. $this->encryptIV = $this->decryptIV = $this->iv = str_pad(substr($this->iv, 0, 16), 16, chr(0));
  437. if (!isset($this->enmcrypt)) {
  438. $mode = $this->mode;
  439. //$mode = $this->mode == self::MODE_CTR ? MCRYPT_MODE_ECB : $this->mode;
  440. $this->demcrypt = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', $mode, '');
  441. $this->enmcrypt = mcrypt_module_open(MCRYPT_RIJNDAEL_128, '', $mode, '');
  442. } // else should mcrypt_generic_deinit be called?
  443. mcrypt_generic_init($this->demcrypt, $this->key, $this->iv);
  444. mcrypt_generic_init($this->enmcrypt, $this->key, $this->iv);
  445. $this->changed = false;
  446. }
  447. /**
  448. * Encrypts a block
  449. *
  450. * Optimized over Crypt_Rijndael's implementation by means of loop unrolling.
  451. *
  452. * @see Crypt_Rijndael::_encryptBlock()
  453. * @access private
  454. * @param String $in
  455. * @return String
  456. */
  457. function _encryptBlock($in)
  458. {
  459. $state = unpack('N*word', $in);
  460. $Nr = $this->Nr;
  461. $w = $this->w;
  462. $t0 = $this->t0;
  463. $t1 = $this->t1;
  464. $t2 = $this->t2;
  465. $t3 = $this->t3;
  466. // addRoundKey and reindex $state
  467. $state = array(
  468. $state['word1'] ^ $w[0][0],
  469. $state['word2'] ^ $w[0][1],
  470. $state['word3'] ^ $w[0][2],
  471. $state['word4'] ^ $w[0][3]
  472. );
  473. // shiftRows + subWord + mixColumns + addRoundKey
  474. // we could loop unroll this and use if statements to do more rounds as necessary, but, in my tests, that yields
  475. // only a marginal improvement. since that also, imho, hinders the readability of the code, i've opted not to do it.
  476. for ($round = 1; $round < $this->Nr; $round++) {
  477. $state = array(
  478. $t0[$state[0] & 0xFF000000] ^ $t1[$state[1] & 0x00FF0000] ^ $t2[$state[2] & 0x0000FF00] ^ $t3[$state[3] & 0x000000FF] ^ $w[$round][0],
  479. $t0[$state[1] & 0xFF000000] ^ $t1[$state[2] & 0x00FF0000] ^ $t2[$state[3] & 0x0000FF00] ^ $t3[$state[0] & 0x000000FF] ^ $w[$round][1],
  480. $t0[$state[2] & 0xFF000000] ^ $t1[$state[3] & 0x00FF0000] ^ $t2[$state[0] & 0x0000FF00] ^ $t3[$state[1] & 0x000000FF] ^ $w[$round][2],
  481. $t0[$state[3] & 0xFF000000] ^ $t1[$state[0] & 0x00FF0000] ^ $t2[$state[1] & 0x0000FF00] ^ $t3[$state[2] & 0x000000FF] ^ $w[$round][3]
  482. );
  483. }
  484. // subWord
  485. $state = array(
  486. $this->_subWord($state[0]),
  487. $this->_subWord($state[1]),
  488. $this->_subWord($state[2]),
  489. $this->_subWord($state[3])
  490. );
  491. // shiftRows + addRoundKey
  492. $state = array(
  493. ($state[0] & 0xFF000000) ^ ($state[1] & 0x00FF0000) ^ ($state[2] & 0x0000FF00) ^ ($state[3] & 0x000000FF) ^ $this->w[$this->Nr][0],
  494. ($state[1] & 0xFF000000) ^ ($state[2] & 0x00FF0000) ^ ($state[3] & 0x0000FF00) ^ ($state[0] & 0x000000FF) ^ $this->w[$this->Nr][1],
  495. ($state[2] & 0xFF000000) ^ ($state[3] & 0x00FF0000) ^ ($state[0] & 0x0000FF00) ^ ($state[1] & 0x000000FF) ^ $this->w[$this->Nr][2],
  496. ($state[3] & 0xFF000000) ^ ($state[0] & 0x00FF0000) ^ ($state[1] & 0x0000FF00) ^ ($state[2] & 0x000000FF) ^ $this->w[$this->Nr][3]
  497. );
  498. return pack('N*', $state[0], $state[1], $state[2], $state[3]);
  499. }
  500. /**
  501. * Decrypts a block
  502. *
  503. * Optimized over Crypt_Rijndael's implementation by means of loop unrolling.
  504. *
  505. * @see Crypt_Rijndael::_decryptBlock()
  506. * @access private
  507. * @param String $in
  508. * @return String
  509. */
  510. function _decryptBlock($in)
  511. {
  512. $state = unpack('N*word', $in);
  513. $Nr = $this->Nr;
  514. $dw = $this->dw;
  515. $dt0 = $this->dt0;
  516. $dt1 = $this->dt1;
  517. $dt2 = $this->dt2;
  518. $dt3 = $this->dt3;
  519. // addRoundKey and reindex $state
  520. $state = array(
  521. $state['word1'] ^ $dw[$this->Nr][0],
  522. $state['word2'] ^ $dw[$this->Nr][1],
  523. $state['word3'] ^ $dw[$this->Nr][2],
  524. $state['word4'] ^ $dw[$this->Nr][3]
  525. );
  526. // invShiftRows + invSubBytes + invMixColumns + addRoundKey
  527. for ($round = $this->Nr - 1; $round > 0; $round--) {
  528. $state = array(
  529. $dt0[$state[0] & 0xFF000000] ^ $dt1[$state[3] & 0x00FF0000] ^ $dt2[$state[2] & 0x0000FF00] ^ $dt3[$state[1] & 0x000000FF] ^ $dw[$round][0],
  530. $dt0[$state[1] & 0xFF000000] ^ $dt1[$state[0] & 0x00FF0000] ^ $dt2[$state[3] & 0x0000FF00] ^ $dt3[$state[2] & 0x000000FF] ^ $dw[$round][1],
  531. $dt0[$state[2] & 0xFF000000] ^ $dt1[$state[1] & 0x00FF0000] ^ $dt2[$state[0] & 0x0000FF00] ^ $dt3[$state[3] & 0x000000FF] ^ $dw[$round][2],
  532. $dt0[$state[3] & 0xFF000000] ^ $dt1[$state[2] & 0x00FF0000] ^ $dt2[$state[1] & 0x0000FF00] ^ $dt3[$state[0] & 0x000000FF] ^ $dw[$round][3]
  533. );
  534. }
  535. // invShiftRows + invSubWord + addRoundKey
  536. $state = array(
  537. $this->_invSubWord(($state[0] & 0xFF000000) ^ ($state[3] & 0x00FF0000) ^ ($state[2] & 0x0000FF00) ^ ($state[1] & 0x000000FF)) ^ $dw[0][0],
  538. $this->_invSubWord(($state[1] & 0xFF000000) ^ ($state[0] & 0x00FF0000) ^ ($state[3] & 0x0000FF00) ^ ($state[2] & 0x000000FF)) ^ $dw[0][1],
  539. $this->_invSubWord(($state[2] & 0xFF000000) ^ ($state[1] & 0x00FF0000) ^ ($state[0] & 0x0000FF00) ^ ($state[3] & 0x000000FF)) ^ $dw[0][2],
  540. $this->_invSubWord(($state[3] & 0xFF000000) ^ ($state[2] & 0x00FF0000) ^ ($state[1] & 0x0000FF00) ^ ($state[0] & 0x000000FF)) ^ $dw[0][3]
  541. );
  542. return pack('N*', $state[0], $state[1], $state[2], $state[3]);
  543. }
  544. }
  545. // vim: ts=4:sw=4:et:
  546. // vim6: fdl=1: