Home Reference Source

src/crypt/aes-decryptor.js

  1. // PKCS7
  2. export function removePadding (buffer) {
  3.   const outputBytes = buffer.byteLength;
  4.   const paddingBytes = outputBytes && (new DataView(buffer)).getUint8(outputBytes - 1);
  5.   if (paddingBytes) {
  6.     return buffer.slice(0, outputBytes - paddingBytes);
  7.   } else {
  8.     return buffer;
  9.   }
  10. }
  11.  
  12. class AESDecryptor {
  13.   constructor () {
  14.     // Static after running initTable
  15.     this.rcon = [0x0, 0x1, 0x2, 0x4, 0x8, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36];
  16.     this.subMix = [new Uint32Array(256), new Uint32Array(256), new Uint32Array(256), new Uint32Array(256)];
  17.     this.invSubMix = [new Uint32Array(256), new Uint32Array(256), new Uint32Array(256), new Uint32Array(256)];
  18.     this.sBox = new Uint32Array(256);
  19.     this.invSBox = new Uint32Array(256);
  20.  
  21.     // Changes during runtime
  22.     this.key = new Uint32Array(0);
  23.  
  24.     this.initTable();
  25.   }
  26.  
  27.   // Using view.getUint32() also swaps the byte order.
  28.   uint8ArrayToUint32Array_ (arrayBuffer) {
  29.     let view = new DataView(arrayBuffer);
  30.     let newArray = new Uint32Array(4);
  31.     for (let i = 0; i < 4; i++) {
  32.       newArray[i] = view.getUint32(i * 4);
  33.     }
  34.  
  35.     return newArray;
  36.   }
  37.  
  38.   initTable () {
  39.     let sBox = this.sBox;
  40.     let invSBox = this.invSBox;
  41.     let subMix = this.subMix;
  42.     let subMix0 = subMix[0];
  43.     let subMix1 = subMix[1];
  44.     let subMix2 = subMix[2];
  45.     let subMix3 = subMix[3];
  46.     let invSubMix = this.invSubMix;
  47.     let invSubMix0 = invSubMix[0];
  48.     let invSubMix1 = invSubMix[1];
  49.     let invSubMix2 = invSubMix[2];
  50.     let invSubMix3 = invSubMix[3];
  51.  
  52.     let d = new Uint32Array(256);
  53.     let x = 0;
  54.     let xi = 0;
  55.     let i = 0;
  56.     for (i = 0; i < 256; i++) {
  57.       if (i < 128) {
  58.         d[i] = i << 1;
  59.       } else {
  60.         d[i] = (i << 1) ^ 0x11b;
  61.       }
  62.     }
  63.  
  64.     for (i = 0; i < 256; i++) {
  65.       let sx = xi ^ (xi << 1) ^ (xi << 2) ^ (xi << 3) ^ (xi << 4);
  66.       sx = (sx >>> 8) ^ (sx & 0xff) ^ 0x63;
  67.       sBox[x] = sx;
  68.       invSBox[sx] = x;
  69.  
  70.       // Compute multiplication
  71.       let x2 = d[x];
  72.       let x4 = d[x2];
  73.       let x8 = d[x4];
  74.  
  75.       // Compute sub/invSub bytes, mix columns tables
  76.       let t = (d[sx] * 0x101) ^ (sx * 0x1010100);
  77.       subMix0[x] = (t << 24) | (t >>> 8);
  78.       subMix1[x] = (t << 16) | (t >>> 16);
  79.       subMix2[x] = (t << 8) | (t >>> 24);
  80.       subMix3[x] = t;
  81.  
  82.       // Compute inv sub bytes, inv mix columns tables
  83.       t = (x8 * 0x1010101) ^ (x4 * 0x10001) ^ (x2 * 0x101) ^ (x * 0x1010100);
  84.       invSubMix0[sx] = (t << 24) | (t >>> 8);
  85.       invSubMix1[sx] = (t << 16) | (t >>> 16);
  86.       invSubMix2[sx] = (t << 8) | (t >>> 24);
  87.       invSubMix3[sx] = t;
  88.  
  89.       // Compute next counter
  90.       if (!x) {
  91.         x = xi = 1;
  92.       } else {
  93.         x = x2 ^ d[d[d[x8 ^ x2]]];
  94.         xi ^= d[d[xi]];
  95.       }
  96.     }
  97.   }
  98.  
  99.   expandKey (keyBuffer) {
  100.     // convert keyBuffer to Uint32Array
  101.     let key = this.uint8ArrayToUint32Array_(keyBuffer);
  102.     let sameKey = true;
  103.     let offset = 0;
  104.  
  105.     while (offset < key.length && sameKey) {
  106.       sameKey = (key[offset] === this.key[offset]);
  107.       offset++;
  108.     }
  109.  
  110.     if (sameKey) {
  111.       return;
  112.     }
  113.  
  114.     this.key = key;
  115.     let keySize = this.keySize = key.length;
  116.  
  117.     if (keySize !== 4 && keySize !== 6 && keySize !== 8) {
  118.       throw new Error('Invalid aes key size=' + keySize);
  119.     }
  120.  
  121.     let ksRows = this.ksRows = (keySize + 6 + 1) * 4;
  122.     let ksRow;
  123.     let invKsRow;
  124.  
  125.     let keySchedule = this.keySchedule = new Uint32Array(ksRows);
  126.     let invKeySchedule = this.invKeySchedule = new Uint32Array(ksRows);
  127.     let sbox = this.sBox;
  128.     let rcon = this.rcon;
  129.  
  130.     let invSubMix = this.invSubMix;
  131.     let invSubMix0 = invSubMix[0];
  132.     let invSubMix1 = invSubMix[1];
  133.     let invSubMix2 = invSubMix[2];
  134.     let invSubMix3 = invSubMix[3];
  135.  
  136.     let prev;
  137.     let t;
  138.  
  139.     for (ksRow = 0; ksRow < ksRows; ksRow++) {
  140.       if (ksRow < keySize) {
  141.         prev = keySchedule[ksRow] = key[ksRow];
  142.         continue;
  143.       }
  144.       t = prev;
  145.  
  146.       if (ksRow % keySize === 0) {
  147.         // Rot word
  148.         t = (t << 8) | (t >>> 24);
  149.  
  150.         // Sub word
  151.         t = (sbox[t >>> 24] << 24) | (sbox[(t >>> 16) & 0xff] << 16) | (sbox[(t >>> 8) & 0xff] << 8) | sbox[t & 0xff];
  152.  
  153.         // Mix Rcon
  154.         t ^= rcon[(ksRow / keySize) | 0] << 24;
  155.       } else if (keySize > 6 && ksRow % keySize === 4) {
  156.         // Sub word
  157.         t = (sbox[t >>> 24] << 24) | (sbox[(t >>> 16) & 0xff] << 16) | (sbox[(t >>> 8) & 0xff] << 8) | sbox[t & 0xff];
  158.       }
  159.  
  160.       keySchedule[ksRow] = prev = (keySchedule[ksRow - keySize] ^ t) >>> 0;
  161.     }
  162.  
  163.     for (invKsRow = 0; invKsRow < ksRows; invKsRow++) {
  164.       ksRow = ksRows - invKsRow;
  165.       if (invKsRow & 3) {
  166.         t = keySchedule[ksRow];
  167.       } else {
  168.         t = keySchedule[ksRow - 4];
  169.       }
  170.  
  171.       if (invKsRow < 4 || ksRow <= 4) {
  172.         invKeySchedule[invKsRow] = t;
  173.       } else {
  174.         invKeySchedule[invKsRow] = invSubMix0[sbox[t >>> 24]] ^ invSubMix1[sbox[(t >>> 16) & 0xff]] ^ invSubMix2[sbox[(t >>> 8) & 0xff]] ^ invSubMix3[sbox[t & 0xff]];
  175.       }
  176.  
  177.       invKeySchedule[invKsRow] = invKeySchedule[invKsRow] >>> 0;
  178.     }
  179.   }
  180.  
  181.   // Adding this as a method greatly improves performance.
  182.   networkToHostOrderSwap (word) {
  183.     return (word << 24) | ((word & 0xff00) << 8) | ((word & 0xff0000) >> 8) | (word >>> 24);
  184.   }
  185.  
  186.   decrypt (inputArrayBuffer, offset, aesIV, removePKCS7Padding) {
  187.     let nRounds = this.keySize + 6;
  188.     let invKeySchedule = this.invKeySchedule;
  189.     let invSBOX = this.invSBox;
  190.  
  191.     let invSubMix = this.invSubMix;
  192.     let invSubMix0 = invSubMix[0];
  193.     let invSubMix1 = invSubMix[1];
  194.     let invSubMix2 = invSubMix[2];
  195.     let invSubMix3 = invSubMix[3];
  196.  
  197.     let initVector = this.uint8ArrayToUint32Array_(aesIV);
  198.     let initVector0 = initVector[0];
  199.     let initVector1 = initVector[1];
  200.     let initVector2 = initVector[2];
  201.     let initVector3 = initVector[3];
  202.  
  203.     let inputInt32 = new Int32Array(inputArrayBuffer);
  204.     let outputInt32 = new Int32Array(inputInt32.length);
  205.  
  206.     let t0, t1, t2, t3;
  207.     let s0, s1, s2, s3;
  208.     let inputWords0, inputWords1, inputWords2, inputWords3;
  209.  
  210.     let ksRow, i;
  211.     let swapWord = this.networkToHostOrderSwap;
  212.  
  213.     while (offset < inputInt32.length) {
  214.       inputWords0 = swapWord(inputInt32[offset]);
  215.       inputWords1 = swapWord(inputInt32[offset + 1]);
  216.       inputWords2 = swapWord(inputInt32[offset + 2]);
  217.       inputWords3 = swapWord(inputInt32[offset + 3]);
  218.  
  219.       s0 = inputWords0 ^ invKeySchedule[0];
  220.       s1 = inputWords3 ^ invKeySchedule[1];
  221.       s2 = inputWords2 ^ invKeySchedule[2];
  222.       s3 = inputWords1 ^ invKeySchedule[3];
  223.  
  224.       ksRow = 4;
  225.  
  226.       // Iterate through the rounds of decryption
  227.       for (i = 1; i < nRounds; i++) {
  228.         t0 = invSubMix0[s0 >>> 24] ^ invSubMix1[(s1 >> 16) & 0xff] ^ invSubMix2[(s2 >> 8) & 0xff] ^ invSubMix3[s3 & 0xff] ^ invKeySchedule[ksRow];
  229.         t1 = invSubMix0[s1 >>> 24] ^ invSubMix1[(s2 >> 16) & 0xff] ^ invSubMix2[(s3 >> 8) & 0xff] ^ invSubMix3[s0 & 0xff] ^ invKeySchedule[ksRow + 1];
  230.         t2 = invSubMix0[s2 >>> 24] ^ invSubMix1[(s3 >> 16) & 0xff] ^ invSubMix2[(s0 >> 8) & 0xff] ^ invSubMix3[s1 & 0xff] ^ invKeySchedule[ksRow + 2];
  231.         t3 = invSubMix0[s3 >>> 24] ^ invSubMix1[(s0 >> 16) & 0xff] ^ invSubMix2[(s1 >> 8) & 0xff] ^ invSubMix3[s2 & 0xff] ^ invKeySchedule[ksRow + 3];
  232.         // Update state
  233.         s0 = t0;
  234.         s1 = t1;
  235.         s2 = t2;
  236.         s3 = t3;
  237.  
  238.         ksRow = ksRow + 4;
  239.       }
  240.  
  241.       // Shift rows, sub bytes, add round key
  242.       t0 = ((invSBOX[s0 >>> 24] << 24) ^ (invSBOX[(s1 >> 16) & 0xff] << 16) ^ (invSBOX[(s2 >> 8) & 0xff] << 8) ^ invSBOX[s3 & 0xff]) ^ invKeySchedule[ksRow];
  243.       t1 = ((invSBOX[s1 >>> 24] << 24) ^ (invSBOX[(s2 >> 16) & 0xff] << 16) ^ (invSBOX[(s3 >> 8) & 0xff] << 8) ^ invSBOX[s0 & 0xff]) ^ invKeySchedule[ksRow + 1];
  244.       t2 = ((invSBOX[s2 >>> 24] << 24) ^ (invSBOX[(s3 >> 16) & 0xff] << 16) ^ (invSBOX[(s0 >> 8) & 0xff] << 8) ^ invSBOX[s1 & 0xff]) ^ invKeySchedule[ksRow + 2];
  245.       t3 = ((invSBOX[s3 >>> 24] << 24) ^ (invSBOX[(s0 >> 16) & 0xff] << 16) ^ (invSBOX[(s1 >> 8) & 0xff] << 8) ^ invSBOX[s2 & 0xff]) ^ invKeySchedule[ksRow + 3];
  246.       ksRow = ksRow + 3;
  247.  
  248.       // Write
  249.       outputInt32[offset] = swapWord(t0 ^ initVector0);
  250.       outputInt32[offset + 1] = swapWord(t3 ^ initVector1);
  251.       outputInt32[offset + 2] = swapWord(t2 ^ initVector2);
  252.       outputInt32[offset + 3] = swapWord(t1 ^ initVector3);
  253.  
  254.       // reset initVector to last 4 unsigned int
  255.       initVector0 = inputWords0;
  256.       initVector1 = inputWords1;
  257.       initVector2 = inputWords2;
  258.       initVector3 = inputWords3;
  259.  
  260.       offset = offset + 4;
  261.     }
  262.  
  263.     return removePKCS7Padding ? removePadding(outputInt32.buffer) : outputInt32.buffer;
  264.   }
  265.  
  266.   destroy () {
  267.     this.key = undefined;
  268.     this.keySize = undefined;
  269.     this.ksRows = undefined;
  270.  
  271.     this.sBox = undefined;
  272.     this.invSBox = undefined;
  273.     this.subMix = undefined;
  274.     this.invSubMix = undefined;
  275.     this.keySchedule = undefined;
  276.     this.invKeySchedule = undefined;
  277.  
  278.     this.rcon = undefined;
  279.   }
  280. }
  281.  
  282. export default AESDecryptor;