Lines Matching +full:2 +full:c
1 /* SPDX-License-Identifier: Apache-2.0 OR BSD-2-Clause */
14 // Copyright (c) 2023, Christoph Müllner <[email protected]>
15 // Copyright (c) 2023, Phoebe Chen <[email protected]>
16 // Copyright (c) 2023, Jerry Shih <[email protected]>
25 // 2. Redistributions in binary form must reproduce the above copyright
87 srli t0, LEN, 2
92 slli t1, t1, 2 // Words to bytes
142 srli LEN, LEN, 2 // Convert LEN from bytes to words
154 slli t1, t0, 2 // Words to bytes
195 j 2f
199 2:
211 // C[n-1] = Encrypt(Encrypt(P[n-1] ^ C[n-2]) ^ P[n])
212 // C[n] = Encrypt(P[n-1] ^ C[n-2])[0..LEN]
214 // C[i] denotes the i'th ciphertext block, and likewise P[i] the i'th
216 // is 1 <= LEN <= 16. If there are only 2 blocks, C[n-2] means the IV.
218 // v16 already contains Encrypt(P[n-1] ^ C[n-2]).
219 // INP points to P[n]. OUTP points to where C[n-1] should go.
220 // To support in-place encryption, load P[n] before storing C[n].
221 addi t0, OUTP, 16 // Get pointer to where C[n] should go
224 vse8.v v16, (t0) // Store C[n]
225 vxor.vv v16, v16, v17 // v16 = Encrypt(P[n-1] ^ C[n-2]) ^ P[n]
229 vse32.v v16, (OUTP) // Store C[n-1] (or C[n] in single-block case)
238 srli LEN32, LEN32, 2
241 // Save C[n-2] in v28 so that it's available later during the ciphertext
242 // stealing step. If there are fewer than three blocks, C[n-2] means
251 // CBC-decrypt all full blocks. For the last full block, or the last 2
268 slli t0, t0, 2 // Words to bytes
282 // Block-aligned message. Just fix up the last 2 blocks. We need:
284 // P[n-1] = Decrypt(C[n]) ^ C[n-2]
285 // P[n] = Decrypt(C[n-1]) ^ C[n]
287 // We have C[n] in v16, Decrypt(C[n]) in v20, and C[n-2] in v28.
288 // Together with Decrypt(C[n-1]) ^ C[n-2] from the output buffer, this
291 vxor.vv v20, v20, v28 // Decrypt(C[n]) ^ C[n-2] == P[n-1]
292 vle32.v v24, (t1) // Decrypt(C[n-1]) ^ C[n-2]
294 vxor.vv v20, v24, v16 // Decrypt(C[n-1]) ^ C[n-2] ^ C[n] == P[n] ^ C[n-2]
300 // P[n-1] = Decrypt(C[n] || Decrypt(C[n-1])[LEN_MOD16..16]) ^ C[n-2]
301 // P[n] = (Decrypt(C[n-1]) ^ C[n])[0..LEN_MOD16]
303 // We already have Decrypt(C[n-1]) in v20 and C[n-2] in v28.
304 vmv.v.v v16, v20 // v16 = Decrypt(C[n-1])
306 vle8.v v20, (INP) // v20 = C[n] || Decrypt(C[n-1])[LEN_MOD16..16]
307 vxor.vv v16, v16, v20 // v16 = Decrypt(C[n-1]) ^ C[n]
310 aes_decrypt v20, \keylen // v20 = Decrypt(C[n] || Decrypt(C[n-1])[LEN_MOD16..16])
312 vxor.vv v20, v20, v28 // XOR with C[n-2]