1

所以这是我的问题.. 我正在为一个库写一个 AES-NI 实现，我被困在一个 256 位块的解密上。这是我所知道的.. 128 位块完美运行。256 块的加密与经过验证的 Rijndael 实现一致。扩展键也与其他 Rijndael 实现对齐（允许小端字节顺序）。该例程使用混合和移位掩码来补偿 256 位块的偏移列混洗，它与用于加密块的掩码相反，这也经过测试并且似乎工作正常。这是加密功能：

    void Encrypt32(const std::vector<byte> &Input, const size_t InOffset, std::vector<byte> &Output, const size_t OutOffset)
{
    const size_t LRD = m_expKey.size() - 3;
    size_t keyCtr = 0;
    __m128i RIJNDAEL256_MASK = { 0,1,6,7,4,5,10,11,8,9,14,15,12,13,2,3 };
    __m128i BLEND_MASK = _mm_set_epi32(0x80000000, 0x80800000, 0x80800000, 0x80808000);
    __m128i block1 = _mm_loadu_si128((const __m128i*)(const void*)&Input[InOffset]);
    __m128i block2 = _mm_loadu_si128((const __m128i*)(const void*)&Input[InOffset + 16]);
    __m128i temp1, temp2;

    block1 = _mm_xor_si128(block1, m_expKey[keyCtr]);
    block2 = _mm_xor_si128(block2, m_expKey[++keyCtr]);

    while (keyCtr != LRD)
    {
        temp1 = _mm_blendv_epi8(block1, block2, BLEND_MASK);    // combine 2 blocks
        temp2 = _mm_blendv_epi8(block2, block1, BLEND_MASK);
        temp1 = _mm_shuffle_epi8(temp1, RIJNDAEL256_MASK);      // shuffle
        temp2 = _mm_shuffle_epi8(temp2, RIJNDAEL256_MASK);
        block1 = _mm_aesenc_si128(temp1, m_expKey[++keyCtr]);   // encrypt
        block2 = _mm_aesenc_si128(temp2, m_expKey[++keyCtr]);
    }

    temp1 = _mm_blendv_epi8(block1, block2, BLEND_MASK);
    temp2 = _mm_blendv_epi8(block2, block1, BLEND_MASK);
    temp1 = _mm_shuffle_epi8(temp1, RIJNDAEL256_MASK);
    temp2 = _mm_shuffle_epi8(temp2, RIJNDAEL256_MASK);
    block1 = _mm_aesenclast_si128(temp1, m_expKey[++keyCtr]);
    block2 = _mm_aesenclast_si128(temp2, m_expKey[++keyCtr]);

    _mm_storeu_si128((__m128i*)(void*)&Output[OutOffset], block1);
    _mm_storeu_si128((__m128i*)(void*)&Output[OutOffset + 16], block2);
}

这是逆变换：

    void Decrypt32(const std::vector<byte> &Input, const size_t InOffset, std::vector<byte> &Output, const size_t OutOffset)
{
    const size_t LRD = m_expKey.size() - 3;
    __m128i RIJNDAELINV_MASK = { 0,1,14,15,4,5,2,3,8,9,6,7,12,13,10,11 };
    __m128i BLEND_MASK = _mm_set_epi32(0x80000000, 0x80800000, 0x80800000, 0x80808000);
    __m128i block1 = _mm_loadu_si128((const __m128i*)(const void*)&Input[InOffset]);
    __m128i block2 = _mm_loadu_si128((const __m128i*)(const void*)&Input[InOffset + 16]);
    __m128i temp1, temp2;
    size_t keyCtr = 0;

    block1 = _mm_xor_si128(block1, m_expKey[keyCtr]);
    block2 = _mm_xor_si128(block2, m_expKey[++keyCtr]);

    while (keyCtr != LRD)
    {
        temp1 = _mm_aesdec_si128(block1, m_expKey[++keyCtr]);   // decrypt
        temp2 = _mm_aesdec_si128(block2, m_expKey[++keyCtr]);
        temp1 = _mm_shuffle_epi8(temp1, RIJNDAELINV_MASK);      // shuffle
        temp2 = _mm_shuffle_epi8(temp2, RIJNDAELINV_MASK);
        block1 = _mm_blendv_epi8(temp1, temp2, BLEND_MASK);     // combine
        block2 = _mm_blendv_epi8(temp2, temp1, BLEND_MASK);
    }

    temp1 = _mm_aesdeclast_si128(block1, m_expKey[++keyCtr]);
    temp2 = _mm_aesdeclast_si128(block2, m_expKey[++keyCtr]);
    temp1 = _mm_shuffle_epi8(temp1, RIJNDAELINV_MASK);
    temp2 = _mm_shuffle_epi8(temp2, RIJNDAELINV_MASK);
    block1 = _mm_blendv_epi8(temp1, temp2, BLEND_MASK);
    block2 = _mm_blendv_epi8(temp2, temp1, BLEND_MASK);

    _mm_storeu_si128((__m128i*)(void*)&Output[OutOffset], block1);
    _mm_storeu_si128((__m128i*)(void*)&Output[OutOffset + 16], block2);
}

我已经调试了好几个小时，但无法发现问题，谁能明白为什么这不起作用？如果有帮助，我可以将代码发布到 git。

4

0 回答 0