contact-forms / phpseclib-crypt / Rijndael.php

Rijndael.php in Contact Forms by Cimatti 1.0, at phpseclib-crypt/Rijndael.php

1,479 lines 57.2 KB

Raw Download Zip

1	<?php
2	/* vim: set expandtab tabstop=4 shiftwidth=4 softtabstop=4: */
3
4	/**
5	* Pure-PHP implementation of Rijndael.
6	*
7	* Does not use mcrypt, even when available, for reasons that are explained below.
8	*
9	* PHP versions 4 and 5
10	*
11	* If {@link Crypt_Rijndael::setBlockLength() setBlockLength()} isn't called, it'll be assumed to be 128 bits. If
12	* {@link Crypt_Rijndael::setKeyLength() setKeyLength()} isn't called, it'll be calculated from
13	* {@link Crypt_Rijndael::setKey() setKey()}. ie. if the key is 128-bits, the key length will be 128-bits. If it's
14	* 136-bits it'll be null-padded to 160-bits and 160 bits will be the key length until
15	* {@link Crypt_Rijndael::setKey() setKey()} is called, again, at which point, it'll be recalculated.
16	*
17	* Not all Rijndael implementations may support 160-bits or 224-bits as the block length / key length. mcrypt, for example,
18	* does not. AES, itself, only supports block lengths of 128 and key lengths of 128, 192, and 256.
19	* {@link http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=10 Rijndael-ammended.pdf#page=10} defines the
20	* algorithm for block lengths of 192 and 256 but not for block lengths / key lengths of 160 and 224. Indeed, 160 and 224
21	* are first defined as valid key / block lengths in
22	* {@link http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=44 Rijndael-ammended.pdf#page=44}:
23	* Extensions: Other block and Cipher Key lengths.
24	*
25	* {@internal The variable names are the same as those in
26	* {@link http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf#page=10 fips-197.pdf#page=10}.}}
27	*
28	* Here's a short example of how to use this library:
29	* <code>
30	* <?php
31	* include('Crypt/Rijndael.php');
32	*
33	* $rijndael = new Crypt_Rijndael();
34	*
35	* $rijndael->setKey('abcdefghijklmnop');
36	*
37	* $size = 10 * 1024;
38	* $plaintext = '';
39	* for ($i = 0; $i < $size; $i++) {
40	* $plaintext.= 'a';
41	* }
42	*
43	* echo $rijndael->decrypt($rijndael->encrypt($plaintext));
44	* ?>
45	* </code>
46	*
47	* LICENSE: Permission is hereby granted, free of charge, to any person obtaining a copy
48	* of this software and associated documentation files (the "Software"), to deal
49	* in the Software without restriction, including without limitation the rights
50	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
51	* copies of the Software, and to permit persons to whom the Software is
52	* furnished to do so, subject to the following conditions:
53	*
54	* The above copyright notice and this permission notice shall be included in
55	* all copies or substantial portions of the Software.
56	*
57	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
58	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
59	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
60	* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
61	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
62	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
63	* THE SOFTWARE.
64	*
65	* @category Crypt
66	* @package Crypt_Rijndael
67	* @author Jim Wigginton <terrafrost@php.net>
68	* @copyright MMVIII Jim Wigginton
69	* @license http://www.opensource.org/licenses/mit-license.html MIT License
70	* @version $Id: Rijndael.php,v 1.12 2010/02/09 06:10:26 terrafrost Exp $
71	* @link http://phpseclib.sourceforge.net
72	*/
73
74	/**#@+
75	* @access public
76	* @see Crypt_Rijndael::encrypt()
77	* @see Crypt_Rijndael::decrypt()
78	*/
79	/**
80	* Encrypt / decrypt using the Counter mode.
81	*
82	* Set to -1 since that's what Crypt/Random.php uses to index the CTR mode.
83	*
84	* @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Counter_.28CTR.29
85	*/
86	define('CRYPT_RIJNDAEL_MODE_CTR', -1);
87	/**
88	* Encrypt / decrypt using the Electronic Code Book mode.
89	*
90	* @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Electronic_codebook_.28ECB.29
91	*/
92	define('CRYPT_RIJNDAEL_MODE_ECB', 1);
93	/**
94	* Encrypt / decrypt using the Code Book Chaining mode.
95	*
96	* @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher-block_chaining_.28CBC.29
97	*/
98	define('CRYPT_RIJNDAEL_MODE_CBC', 2);
99	/**
100	* Encrypt / decrypt using the Cipher Feedback mode.
101	*
102	* @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Cipher_feedback_.28CFB.29
103	*/
104	define('CRYPT_RIJNDAEL_MODE_CFB', 3);
105	/**
106	* Encrypt / decrypt using the Cipher Feedback mode.
107	*
108	* @link http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation#Output_feedback_.28OFB.29
109	*/
110	define('CRYPT_RIJNDAEL_MODE_OFB', 4);
111	/*#@-/
112
113	/**#@+
114	* @access private
115	* @see Crypt_Rijndael::Crypt_Rijndael()
116	*/
117	/**
118	* Toggles the internal implementation
119	*/
120	define('CRYPT_RIJNDAEL_MODE_INTERNAL', 1);
121	/**
122	* Toggles the mcrypt implementation
123	*/
124	define('CRYPT_RIJNDAEL_MODE_MCRYPT', 2);
125	/*#@-/
126
127	/**
128	* Pure-PHP implementation of Rijndael.
129	*
130	* @author Jim Wigginton <terrafrost@php.net>
131	* @version 0.1.0
132	* @access public
133	* @package Crypt_Rijndael
134	*/
135	class Crypt_Rijndael {
136	/**
137	* The Encryption Mode
138	*
139	* @see Crypt_Rijndael::Crypt_Rijndael()
140	* @var Integer
141	* @access private
142	*/
143	var $mode;
144
145	/**
146	* The Key
147	*
148	* @see Crypt_Rijndael::setKey()
149	* @var String
150	* @access private
151	*/
152	var $key = "\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0";
153
154	/**
155	* The Initialization Vector
156	*
157	* @see Crypt_Rijndael::setIV()
158	* @var String
159	* @access private
160	*/
161	var $iv = '';
162
163	/**
164	* A "sliding" Initialization Vector
165	*
166	* @see Crypt_Rijndael::enableContinuousBuffer()
167	* @var String
168	* @access private
169	*/
170	var $encryptIV = '';
171
172	/**
173	* A "sliding" Initialization Vector
174	*
175	* @see Crypt_Rijndael::enableContinuousBuffer()
176	* @var String
177	* @access private
178	*/
179	var $decryptIV = '';
180
181	/**
182	* Continuous Buffer status
183	*
184	* @see Crypt_Rijndael::enableContinuousBuffer()
185	* @var Boolean
186	* @access private
187	*/
188	var $continuousBuffer = false;
189
190	/**
191	* Padding status
192	*
193	* @see Crypt_Rijndael::enablePadding()
194	* @var Boolean
195	* @access private
196	*/
197	var $padding = true;
198
199	/**
200	* Does the key schedule need to be (re)calculated?
201	*
202	* @see setKey()
203	* @see setBlockLength()
204	* @see setKeyLength()
205	* @var Boolean
206	* @access private
207	*/
208	var $changed = true;
209
210	/**
211	* Has the key length explicitly been set or should it be derived from the key, itself?
212	*
213	* @see setKeyLength()
214	* @var Boolean
215	* @access private
216	*/
217	var $explicit_key_length = false;
218
219	/**
220	* The Key Schedule
221	*
222	* @see _setup()
223	* @var Array
224	* @access private
225	*/
226	var $w;
227
228	/**
229	* The Inverse Key Schedule
230	*
231	* @see _setup()
232	* @var Array
233	* @access private
234	*/
235	var $dw;
236
237	/**
238	* The Block Length
239	*
240	* @see setBlockLength()
241	* @var Integer
242	* @access private
243	* @internal The max value is 32, the min value is 16. All valid values are multiples of 4. Exists in conjunction with
244	* $Nb because we need this value and not $Nb to pad strings appropriately.
245	*/
246	var $block_size = 16;
247
248	/**
249	* The Block Length divided by 32
250	*
251	* @see setBlockLength()
252	* @var Integer
253	* @access private
254	* @internal The max value is 256 / 32 = 8, the min value is 128 / 32 = 4. Exists in conjunction with $block_size
255	* because the encryption / decryption / key schedule creation requires this number and not $block_size. We could
256	* derive this from $block_size or vice versa, but that'd mean we'd have to do multiple shift operations, so in lieu
257	* of that, we'll just precompute it once.
258	*
259	*/
260	var $Nb = 4;
261
262	/**
263	* The Key Length
264	*
265	* @see setKeyLength()
266	* @var Integer
267	* @access private
268	* @internal The max value is 256 / 8 = 32, the min value is 128 / 8 = 16. Exists in conjunction with $key_size
269	* because the encryption / decryption / key schedule creation requires this number and not $key_size. We could
270	* derive this from $key_size or vice versa, but that'd mean we'd have to do multiple shift operations, so in lieu
271	* of that, we'll just precompute it once.
272	*/
273	var $key_size = 16;
274
275	/**
276	* The Key Length divided by 32
277	*
278	* @see setKeyLength()
279	* @var Integer
280	* @access private
281	* @internal The max value is 256 / 32 = 8, the min value is 128 / 32 = 4
282	*/
283	var $Nk = 4;
284
285	/**
286	* The Number of Rounds
287	*
288	* @var Integer
289	* @access private
290	* @internal The max value is 14, the min value is 10.
291	*/
292	var $Nr;
293
294	/**
295	* Shift offsets
296	*
297	* @var Array
298	* @access private
299	*/
300	var $c;
301
302	/**
303	* Precomputed mixColumns table
304	*
305	* @see Crypt_Rijndael()
306	* @var Array
307	* @access private
308	*/
309	var $t0;
310
311	/**
312	* Precomputed mixColumns table
313	*
314	* @see Crypt_Rijndael()
315	* @var Array
316	* @access private
317	*/
318	var $t1;
319
320	/**
321	* Precomputed mixColumns table
322	*
323	* @see Crypt_Rijndael()
324	* @var Array
325	* @access private
326	*/
327	var $t2;
328
329	/**
330	* Precomputed mixColumns table
331	*
332	* @see Crypt_Rijndael()
333	* @var Array
334	* @access private
335	*/
336	var $t3;
337
338	/**
339	* Precomputed invMixColumns table
340	*
341	* @see Crypt_Rijndael()
342	* @var Array
343	* @access private
344	*/
345	var $dt0;
346
347	/**
348	* Precomputed invMixColumns table
349	*
350	* @see Crypt_Rijndael()
351	* @var Array
352	* @access private
353	*/
354	var $dt1;
355
356	/**
357	* Precomputed invMixColumns table
358	*
359	* @see Crypt_Rijndael()
360	* @var Array
361	* @access private
362	*/
363	var $dt2;
364
365	/**
366	* Precomputed invMixColumns table
367	*
368	* @see Crypt_Rijndael()
369	* @var Array
370	* @access private
371	*/
372	var $dt3;
373
374	/**
375	* Is the mode one that is paddable?
376	*
377	* @see Crypt_Rijndael::Crypt_Rijndael()
378	* @var Boolean
379	* @access private
380	*/
381	var $paddable = false;
382
383	/**
384	* Encryption buffer for CTR, OFB and CFB modes
385	*
386	* @see Crypt_Rijndael::encrypt()
387	* @var String
388	* @access private
389	*/
390	var $enbuffer = array('encrypted' => '', 'xor' => '');
391
392	/**
393	* Decryption buffer for CTR, OFB and CFB modes
394	*
395	* @see Crypt_Rijndael::decrypt()
396	* @var String
397	* @access private
398	*/
399	var $debuffer = array('ciphertext' => '');
400
401	/**
402	* Default Constructor.
403	*
404	* Determines whether or not the mcrypt extension should be used. $mode should only, at present, be
405	* CRYPT_RIJNDAEL_MODE_ECB or CRYPT_RIJNDAEL_MODE_CBC. If not explictly set, CRYPT_RIJNDAEL_MODE_CBC will be used.
406	*
407	* @param optional Integer $mode
408	* @return Crypt_Rijndael
409	* @access public
410	*/
411	function Crypt_Rijndael($mode = CRYPT_RIJNDAEL_MODE_CBC)
412	{
413	switch ($mode) {
414	case CRYPT_RIJNDAEL_MODE_ECB:
415	case CRYPT_RIJNDAEL_MODE_CBC:
416	$this->paddable = true;
417	$this->mode = $mode;
418	break;
419	case CRYPT_RIJNDAEL_MODE_CTR:
420	case CRYPT_RIJNDAEL_MODE_CFB:
421	case CRYPT_RIJNDAEL_MODE_OFB:
422	$this->mode = $mode;
423	break;
424	default:
425	$this->paddable = true;
426	$this->mode = CRYPT_RIJNDAEL_MODE_CBC;
427	}
428
429	$t3 = &$this->t3;
430	$t2 = &$this->t2;
431	$t1 = &$this->t1;
432	$t0 = &$this->t0;
433
434	$dt3 = &$this->dt3;
435	$dt2 = &$this->dt2;
436	$dt1 = &$this->dt1;
437	$dt0 = &$this->dt0;
438
439	// according to <http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=19> (section 5.2.1),
440	// precomputed tables can be used in the mixColumns phase. in that example, they're assigned t0...t3, so
441	// those are the names we'll use.
442	$t3 = array(
443	0x6363A5C6, 0x7C7C84F8, 0x777799EE, 0x7B7B8DF6, 0xF2F20DFF, 0x6B6BBDD6, 0x6F6FB1DE, 0xC5C55491,
444	0x30305060, 0x01010302, 0x6767A9CE, 0x2B2B7D56, 0xFEFE19E7, 0xD7D762B5, 0xABABE64D, 0x76769AEC,
445	0xCACA458F, 0x82829D1F, 0xC9C94089, 0x7D7D87FA, 0xFAFA15EF, 0x5959EBB2, 0x4747C98E, 0xF0F00BFB,
446	0xADADEC41, 0xD4D467B3, 0xA2A2FD5F, 0xAFAFEA45, 0x9C9CBF23, 0xA4A4F753, 0x727296E4, 0xC0C05B9B,
447	0xB7B7C275, 0xFDFD1CE1, 0x9393AE3D, 0x26266A4C, 0x36365A6C, 0x3F3F417E, 0xF7F702F5, 0xCCCC4F83,
448	0x34345C68, 0xA5A5F451, 0xE5E534D1, 0xF1F108F9, 0x717193E2, 0xD8D873AB, 0x31315362, 0x15153F2A,
449	0x04040C08, 0xC7C75295, 0x23236546, 0xC3C35E9D, 0x18182830, 0x9696A137, 0x05050F0A, 0x9A9AB52F,
450	0x0707090E, 0x12123624, 0x80809B1B, 0xE2E23DDF, 0xEBEB26CD, 0x2727694E, 0xB2B2CD7F, 0x75759FEA,
451	0x09091B12, 0x83839E1D, 0x2C2C7458, 0x1A1A2E34, 0x1B1B2D36, 0x6E6EB2DC, 0x5A5AEEB4, 0xA0A0FB5B,
452	0x5252F6A4, 0x3B3B4D76, 0xD6D661B7, 0xB3B3CE7D, 0x29297B52, 0xE3E33EDD, 0x2F2F715E, 0x84849713,
453	0x5353F5A6, 0xD1D168B9, 0x00000000, 0xEDED2CC1, 0x20206040, 0xFCFC1FE3, 0xB1B1C879, 0x5B5BEDB6,
454	0x6A6ABED4, 0xCBCB468D, 0xBEBED967, 0x39394B72, 0x4A4ADE94, 0x4C4CD498, 0x5858E8B0, 0xCFCF4A85,
455	0xD0D06BBB, 0xEFEF2AC5, 0xAAAAE54F, 0xFBFB16ED, 0x4343C586, 0x4D4DD79A, 0x33335566, 0x85859411,
456	0x4545CF8A, 0xF9F910E9, 0x02020604, 0x7F7F81FE, 0x5050F0A0, 0x3C3C4478, 0x9F9FBA25, 0xA8A8E34B,
457	0x5151F3A2, 0xA3A3FE5D, 0x4040C080, 0x8F8F8A05, 0x9292AD3F, 0x9D9DBC21, 0x38384870, 0xF5F504F1,
458	0xBCBCDF63, 0xB6B6C177, 0xDADA75AF, 0x21216342, 0x10103020, 0xFFFF1AE5, 0xF3F30EFD, 0xD2D26DBF,
459	0xCDCD4C81, 0x0C0C1418, 0x13133526, 0xECEC2FC3, 0x5F5FE1BE, 0x9797A235, 0x4444CC88, 0x1717392E,
460	0xC4C45793, 0xA7A7F255, 0x7E7E82FC, 0x3D3D477A, 0x6464ACC8, 0x5D5DE7BA, 0x19192B32, 0x737395E6,
461	0x6060A0C0, 0x81819819, 0x4F4FD19E, 0xDCDC7FA3, 0x22226644, 0x2A2A7E54, 0x9090AB3B, 0x8888830B,
462	0x4646CA8C, 0xEEEE29C7, 0xB8B8D36B, 0x14143C28, 0xDEDE79A7, 0x5E5EE2BC, 0x0B0B1D16, 0xDBDB76AD,
463	0xE0E03BDB, 0x32325664, 0x3A3A4E74, 0x0A0A1E14, 0x4949DB92, 0x06060A0C, 0x24246C48, 0x5C5CE4B8,
464	0xC2C25D9F, 0xD3D36EBD, 0xACACEF43, 0x6262A6C4, 0x9191A839, 0x9595A431, 0xE4E437D3, 0x79798BF2,
465	0xE7E732D5, 0xC8C8438B, 0x3737596E, 0x6D6DB7DA, 0x8D8D8C01, 0xD5D564B1, 0x4E4ED29C, 0xA9A9E049,
466	0x6C6CB4D8, 0x5656FAAC, 0xF4F407F3, 0xEAEA25CF, 0x6565AFCA, 0x7A7A8EF4, 0xAEAEE947, 0x08081810,
467	0xBABAD56F, 0x787888F0, 0x25256F4A, 0x2E2E725C, 0x1C1C2438, 0xA6A6F157, 0xB4B4C773, 0xC6C65197,
468	0xE8E823CB, 0xDDDD7CA1, 0x74749CE8, 0x1F1F213E, 0x4B4BDD96, 0xBDBDDC61, 0x8B8B860D, 0x8A8A850F,
469	0x707090E0, 0x3E3E427C, 0xB5B5C471, 0x6666AACC, 0x4848D890, 0x03030506, 0xF6F601F7, 0x0E0E121C,
470	0x6161A3C2, 0x35355F6A, 0x5757F9AE, 0xB9B9D069, 0x86869117, 0xC1C15899, 0x1D1D273A, 0x9E9EB927,
471	0xE1E138D9, 0xF8F813EB, 0x9898B32B, 0x11113322, 0x6969BBD2, 0xD9D970A9, 0x8E8E8907, 0x9494A733,
472	0x9B9BB62D, 0x1E1E223C, 0x87879215, 0xE9E920C9, 0xCECE4987, 0x5555FFAA, 0x28287850, 0xDFDF7AA5,
473	0x8C8C8F03, 0xA1A1F859, 0x89898009, 0x0D0D171A, 0xBFBFDA65, 0xE6E631D7, 0x4242C684, 0x6868B8D0,
474	0x4141C382, 0x9999B029, 0x2D2D775A, 0x0F0F111E, 0xB0B0CB7B, 0x5454FCA8, 0xBBBBD66D, 0x16163A2C
475	);
476
477	$dt3 = array(
478	0xF4A75051, 0x4165537E, 0x17A4C31A, 0x275E963A, 0xAB6BCB3B, 0x9D45F11F, 0xFA58ABAC, 0xE303934B,
479	0x30FA5520, 0x766DF6AD, 0xCC769188, 0x024C25F5, 0xE5D7FC4F, 0x2ACBD7C5, 0x35448026, 0x62A38FB5,
480	0xB15A49DE, 0xBA1B6725, 0xEA0E9845, 0xFEC0E15D, 0x2F7502C3, 0x4CF01281, 0x4697A38D, 0xD3F9C66B,
481	0x8F5FE703, 0x929C9515, 0x6D7AEBBF, 0x5259DA95, 0xBE832DD4, 0x7421D358, 0xE0692949, 0xC9C8448E,
482	0xC2896A75, 0x8E7978F4, 0x583E6B99, 0xB971DD27, 0xE14FB6BE, 0x88AD17F0, 0x20AC66C9, 0xCE3AB47D,
483	0xDF4A1863, 0x1A3182E5, 0x51336097, 0x537F4562, 0x6477E0B1, 0x6BAE84BB, 0x81A01CFE, 0x082B94F9,
484	0x48685870, 0x45FD198F, 0xDE6C8794, 0x7BF8B752, 0x73D323AB, 0x4B02E272, 0x1F8F57E3, 0x55AB2A66,
485	0xEB2807B2, 0xB5C2032F, 0xC57B9A86, 0x3708A5D3, 0x2887F230, 0xBFA5B223, 0x036ABA02, 0x16825CED,
486	0xCF1C2B8A, 0x79B492A7, 0x07F2F0F3, 0x69E2A14E, 0xDAF4CD65, 0x05BED506, 0x34621FD1, 0xA6FE8AC4,
487	0x2E539D34, 0xF355A0A2, 0x8AE13205, 0xF6EB75A4, 0x83EC390B, 0x60EFAA40, 0x719F065E, 0x6E1051BD,
488	0x218AF93E, 0xDD063D96, 0x3E05AEDD, 0xE6BD464D, 0x548DB591, 0xC45D0571, 0x06D46F04, 0x5015FF60,
489	0x98FB2419, 0xBDE997D6, 0x4043CC89, 0xD99E7767, 0xE842BDB0, 0x898B8807, 0x195B38E7, 0xC8EEDB79,
490	0x7C0A47A1, 0x420FE97C, 0x841EC9F8, 0x00000000, 0x80868309, 0x2BED4832, 0x1170AC1E, 0x5A724E6C,
491	0x0EFFFBFD, 0x8538560F, 0xAED51E3D, 0x2D392736, 0x0FD9640A, 0x5CA62168, 0x5B54D19B, 0x362E3A24,
492	0x0A67B10C, 0x57E70F93, 0xEE96D2B4, 0x9B919E1B, 0xC0C54F80, 0xDC20A261, 0x774B695A, 0x121A161C,
493	0x93BA0AE2, 0xA02AE5C0, 0x22E0433C, 0x1B171D12, 0x090D0B0E, 0x8BC7ADF2, 0xB6A8B92D, 0x1EA9C814,
494	0xF1198557, 0x75074CAF, 0x99DDBBEE, 0x7F60FDA3, 0x01269FF7, 0x72F5BC5C, 0x663BC544, 0xFB7E345B,
495	0x4329768B, 0x23C6DCCB, 0xEDFC68B6, 0xE4F163B8, 0x31DCCAD7, 0x63851042, 0x97224013, 0xC6112084,
496	0x4A247D85, 0xBB3DF8D2, 0xF93211AE, 0x29A16DC7, 0x9E2F4B1D, 0xB230F3DC, 0x8652EC0D, 0xC1E3D077,
497	0xB3166C2B, 0x70B999A9, 0x9448FA11, 0xE9642247, 0xFC8CC4A8, 0xF03F1AA0, 0x7D2CD856, 0x3390EF22,
498	0x494EC787, 0x38D1C1D9, 0xCAA2FE8C, 0xD40B3698, 0xF581CFA6, 0x7ADE28A5, 0xB78E26DA, 0xADBFA43F,
499	0x3A9DE42C, 0x78920D50, 0x5FCC9B6A, 0x7E466254, 0x8D13C2F6, 0xD8B8E890, 0x39F75E2E, 0xC3AFF582,
500	0x5D80BE9F, 0xD0937C69, 0xD52DA96F, 0x2512B3CF, 0xAC993BC8, 0x187DA710, 0x9C636EE8, 0x3BBB7BDB,
501	0x267809CD, 0x5918F46E, 0x9AB701EC, 0x4F9AA883, 0x956E65E6, 0xFFE67EAA, 0xBCCF0821, 0x15E8E6EF,
502	0xE79BD9BA, 0x6F36CE4A, 0x9F09D4EA, 0xB07CD629, 0xA4B2AF31, 0x3F23312A, 0xA59430C6, 0xA266C035,
503	0x4EBC3774, 0x82CAA6FC, 0x90D0B0E0, 0xA7D81533, 0x04984AF1, 0xECDAF741, 0xCD500E7F, 0x91F62F17,
504	0x4DD68D76, 0xEFB04D43, 0xAA4D54CC, 0x9604DFE4, 0xD1B5E39E, 0x6A881B4C, 0x2C1FB8C1, 0x65517F46,
505	0x5EEA049D, 0x8C355D01, 0x877473FA, 0x0B412EFB, 0x671D5AB3, 0xDBD25292, 0x105633E9, 0xD647136D,
506	0xD7618C9A, 0xA10C7A37, 0xF8148E59, 0x133C89EB, 0xA927EECE, 0x61C935B7, 0x1CE5EDE1, 0x47B13C7A,
507	0xD2DF599C, 0xF2733F55, 0x14CE7918, 0xC737BF73, 0xF7CDEA53, 0xFDAA5B5F, 0x3D6F14DF, 0x44DB8678,
508	0xAFF381CA, 0x68C43EB9, 0x24342C38, 0xA3405FC2, 0x1DC37216, 0xE2250CBC, 0x3C498B28, 0x0D9541FF,
509	0xA8017139, 0x0CB3DE08, 0xB4E49CD8, 0x56C19064, 0xCB84617B, 0x32B670D5, 0x6C5C7448, 0xB85742D0
510	);
511
512	for ($i = 0; $i < 256; $i++) {
513	$t2[$i << 8] = (($t3[$i] << 8) & 0xFFFFFF00) \| (($t3[$i] >> 24) & 0x000000FF);
514	$t1[$i << 16] = (($t3[$i] << 16) & 0xFFFF0000) \| (($t3[$i] >> 16) & 0x0000FFFF);
515	$t0[$i << 24] = (($t3[$i] << 24) & 0xFF000000) \| (($t3[$i] >> 8) & 0x00FFFFFF);
516
517	$dt2[$i << 8] = (($this->dt3[$i] << 8) & 0xFFFFFF00) \| (($dt3[$i] >> 24) & 0x000000FF);
518	$dt1[$i << 16] = (($this->dt3[$i] << 16) & 0xFFFF0000) \| (($dt3[$i] >> 16) & 0x0000FFFF);
519	$dt0[$i << 24] = (($this->dt3[$i] << 24) & 0xFF000000) \| (($dt3[$i] >> 8) & 0x00FFFFFF);
520	}
521	}
522
523	/**
524	* Sets the key.
525	*
526	* Keys can be of any length. Rijndael, itself, requires the use of a key that's between 128-bits and 256-bits long and
527	* whose length is a multiple of 32. If the key is less than 256-bits and the key length isn't set, we round the length
528	* up to the closest valid key length, padding $key with null bytes. If the key is more than 256-bits, we trim the
529	* excess bits.
530	*
531	* If the key is not explicitly set, it'll be assumed to be all null bytes.
532	*
533	* @access public
534	* @param String $key
535	*/
536	function setKey($key)
537	{
538	$this->key = $key;
539	$this->changed = true;
540	}
541
542	/**
543	* Sets the initialization vector. (optional)
544	*
545	* SetIV is not required when CRYPT_RIJNDAEL_MODE_ECB is being used. If not explictly set, it'll be assumed
546	* to be all zero's.
547	*
548	* @access public
549	* @param String $iv
550	*/
551	function setIV($iv)
552	{
553	$this->encryptIV = $this->decryptIV = $this->iv = str_pad(substr($iv, 0, $this->block_size), $this->block_size, chr(0));
554	}
555
556	/**
557	* Sets the key length
558	*
559	* Valid key lengths are 128, 160, 192, 224, and 256. If the length is less than 128, it will be rounded up to
560	* 128. If the length is greater then 128 and invalid, it will be rounded down to the closest valid amount.
561	*
562	* @access public
563	* @param Integer $length
564	*/
565	function setKeyLength($length)
566	{
567	$length >>= 5;
568	if ($length > 8) {
569	$length = 8;
570	} else if ($length < 4) {
571	$length = 4;
572	}
573	$this->Nk = $length;
574	$this->key_size = $length << 2;
575
576	$this->explicit_key_length = true;
577	$this->changed = true;
578	}
579
580	/**
581	* Sets the password.
582	*
583	* Depending on what $method is set to, setPassword()'s (optional) parameters are as follows:
584	* {@link http://en.wikipedia.org/wiki/PBKDF2 pbkdf2}:
585	* $hash, $salt, $count
586	* Set $dkLen by calling setKeyLength()
587	*
588	* @param String $password
589	* @param optional String $method
590	* @access public
591	*/
592	function setPassword($password, $method = 'pbkdf2')
593	{
594	$key = '';
595
596	switch ($method) {
597	default: // 'pbkdf2'
598	list(, , $hash, $salt, $count) = func_get_args();
599	if (!isset($hash)) {
600	$hash = 'sha1';
601	}
602	// WPA and WPA use the SSID as the salt
603	if (!isset($salt)) {
604	$salt = 'phpseclib/salt';
605	}
606	// RFC2898#section-4.2 uses 1,000 iterations by default
607	// WPA and WPA2 use 4,096.
608	if (!isset($count)) {
609	$count = 1000;
610	}
611
612	if (!class_exists('Crypt_Hash')) {
613	require_once('Crypt/Hash.php');
614	}
615
616	$i = 1;
617	while (strlen($key) < $this->key_size) { // $dkLen == $this->key_size
618	//$dk.= $this->_pbkdf($password, $salt, $count, $i++);
619	$hmac = new Crypt_Hash();
620	$hmac->setHash($hash);
621	$hmac->setKey($password);
622	$f = $u = $hmac->hash($salt . pack('N', $i++));
623	for ($j = 2; $j <= $count; $j++) {
624	$u = $hmac->hash($u);
625	$f^= $u;
626	}
627	$key.= $f;
628	}
629	}
630
631	$this->setKey(substr($key, 0, $this->key_size));
632	}
633
634	/**
635	* Sets the block length
636	*
637	* Valid block lengths are 128, 160, 192, 224, and 256. If the length is less than 128, it will be rounded up to
638	* 128. If the length is greater then 128 and invalid, it will be rounded down to the closest valid amount.
639	*
640	* @access public
641	* @param Integer $length
642	*/
643	function setBlockLength($length)
644	{
645	$length >>= 5;
646	if ($length > 8) {
647	$length = 8;
648	} else if ($length < 4) {
649	$length = 4;
650	}
651	$this->Nb = $length;
652	$this->block_size = $length << 2;
653	$this->changed = true;
654	}
655
656	/**
657	* Generate CTR XOR encryption key
658	*
659	* Encrypt the output of this and XOR it against the ciphertext / plaintext to get the
660	* plaintext / ciphertext in CTR mode.
661	*
662	* @see Crypt_Rijndael::decrypt()
663	* @see Crypt_Rijndael::encrypt()
664	* @access public
665	* @param Integer $length
666	* @param String $iv
667	*/
668	function _generate_xor($length, &$iv)
669	{
670	$xor = '';
671	$block_size = $this->block_size;
672	$num_blocks = floor(($length + ($block_size - 1)) / $block_size);
673	for ($i = 0; $i < $num_blocks; $i++) {
674	$xor.= $iv;
675	for ($j = 4; $j <= $block_size; $j+=4) {
676	$temp = substr($iv, -$j, 4);
677	switch ($temp) {
678	case "\xFF\xFF\xFF\xFF":
679	$iv = substr_replace($iv, "\x00\x00\x00\x00", -$j, 4);
680	break;
681	case "\x7F\xFF\xFF\xFF":
682	$iv = substr_replace($iv, "\x80\x00\x00\x00", -$j, 4);
683	break 2;
684	default:
685	extract(unpack('Ncount', $temp));
686	$iv = substr_replace($iv, pack('N', $count + 1), -$j, 4);
687	break 2;
688	}
689	}
690	}
691
692	return $xor;
693	}
694
695	/**
696	* Encrypts a message.
697	*
698	* $plaintext will be padded with additional bytes such that it's length is a multiple of the block size. Other Rjindael
699	* implementations may or may not pad in the same manner. Other common approaches to padding and the reasons why it's
700	* necessary are discussed in the following
701	* URL:
702	*
703	* {@link http://www.di-mgt.com.au/cryptopad.html http://www.di-mgt.com.au/cryptopad.html}
704	*
705	* An alternative to padding is to, separately, send the length of the file. This is what SSH, in fact, does.
706	* strlen($plaintext) will still need to be a multiple of 8, however, arbitrary values can be added to make it that
707	* length.
708	*
709	* @see Crypt_Rijndael::decrypt()
710	* @access public
711	* @param String $plaintext
712	*/
713	function encrypt($plaintext)
714	{
715	$this->_setup();
716	if ($this->paddable) {
717	$plaintext = $this->_pad($plaintext);
718	}
719
720	$block_size = $this->block_size;
721	$buffer = &$this->enbuffer;
722	$continuousBuffer = $this->continuousBuffer;
723	$ciphertext = '';
724	switch ($this->mode) {
725	case CRYPT_RIJNDAEL_MODE_ECB:
726	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
727	$ciphertext.= $this->_encryptBlock(substr($plaintext, $i, $block_size));
728	}
729	break;
730	case CRYPT_RIJNDAEL_MODE_CBC:
731	$xor = $this->encryptIV;
732	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
733	$block = substr($plaintext, $i, $block_size);
734	$block = $this->_encryptBlock($block ^ $xor);
735	$xor = $block;
736	$ciphertext.= $block;
737	}
738	if ($this->continuousBuffer) {
739	$this->encryptIV = $xor;
740	}
741	break;
742	case CRYPT_RIJNDAEL_MODE_CTR:
743	$xor = $this->encryptIV;
744	if (!empty($buffer['encrypted'])) {
745	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
746	$block = substr($plaintext, $i, $block_size);
747	$buffer['encrypted'].= $this->_encryptBlock($this->_generate_xor($block_size, $xor));
748	$key = $this->_string_shift($buffer['encrypted'], $block_size);
749	$ciphertext.= $block ^ $key;
750	}
751	} else {
752	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
753	$block = substr($plaintext, $i, $block_size);
754	$key = $this->_encryptBlock($this->_generate_xor($block_size, $xor));
755	$ciphertext.= $block ^ $key;
756	}
757	}
758	if ($this->continuousBuffer) {
759	$this->encryptIV = $xor;
760	if ($start = strlen($plaintext) % $block_size) {
761	$buffer['encrypted'] = substr($key, $start) . $buffer['encrypted'];
762	}
763	}
764	break;
765	case CRYPT_RIJNDAEL_MODE_CFB:
766	if (!empty($buffer['xor'])) {
767	$ciphertext = $plaintext ^ $buffer['xor'];
768	$iv = $buffer['encrypted'] . $ciphertext;
769	$start = strlen($ciphertext);
770	$buffer['encrypted'].= $ciphertext;
771	$buffer['xor'] = substr($buffer['xor'], strlen($ciphertext));
772	} else {
773	$ciphertext = '';
774	$iv = $this->encryptIV;
775	$start = 0;
776	}
777
778	for ($i = $start; $i < strlen($plaintext); $i+=$block_size) {
779	$block = substr($plaintext, $i, $block_size);
780	$xor = $this->_encryptBlock($iv);
781	$iv = $block ^ $xor;
782	if ($continuousBuffer && strlen($iv) != $block_size) {
783	$buffer = array(
784	'encrypted' => $iv,
785	'xor' => substr($xor, strlen($iv))
786	);
787	}
788	$ciphertext.= $iv;
789	}
790
791	if ($this->continuousBuffer) {
792	$this->encryptIV = $iv;
793	}
794	break;
795	case CRYPT_RIJNDAEL_MODE_OFB:
796	$xor = $this->encryptIV;
797	if (strlen($buffer)) {
798	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
799	$xor = $this->_encryptBlock($xor);
800	$buffer.= $xor;
801	$key = $this->_string_shift($buffer, $block_size);
802	$ciphertext.= substr($plaintext, $i, $block_size) ^ $key;
803	}
804	} else {
805	for ($i = 0; $i < strlen($plaintext); $i+=$block_size) {
806	$xor = $this->_encryptBlock($xor);
807	$ciphertext.= substr($plaintext, $i, $block_size) ^ $xor;
808	}
809	$key = $xor;
810	}
811	if ($this->continuousBuffer) {
812	$this->encryptIV = $xor;
813	if ($start = strlen($plaintext) % $block_size) {
814	$buffer = substr($key, $start) . $buffer;
815	}
816	}
817	}
818
819	return $ciphertext;
820	}
821
822	/**
823	* Decrypts a message.
824	*
825	* If strlen($ciphertext) is not a multiple of the block size, null bytes will be added to the end of the string until
826	* it is.
827	*
828	* @see Crypt_Rijndael::encrypt()
829	* @access public
830	* @param String $ciphertext
831	*/
832	function decrypt($ciphertext)
833	{
834	$this->_setup();
835
836	if ($this->paddable) {
837	// we pad with chr(0) since that's what mcrypt_generic does. to quote from http://php.net/function.mcrypt-generic :
838	// "The data is padded with "\0" to make sure the length of the data is n * blocksize."
839	$ciphertext = str_pad($ciphertext, strlen($ciphertext) + ($this->block_size - strlen($ciphertext) % $this->block_size) % $this->block_size, chr(0));
840	}
841
842	$block_size = $this->block_size;
843	$buffer = &$this->debuffer;
844	$continuousBuffer = $this->continuousBuffer;
845	$plaintext = '';
846	switch ($this->mode) {
847	case CRYPT_RIJNDAEL_MODE_ECB:
848	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
849	$plaintext.= $this->_decryptBlock(substr($ciphertext, $i, $block_size));
850	}
851	break;
852	case CRYPT_RIJNDAEL_MODE_CBC:
853	$xor = $this->decryptIV;
854	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
855	$block = substr($ciphertext, $i, $block_size);
856	$plaintext.= $this->_decryptBlock($block) ^ $xor;
857	$xor = $block;
858	}
859	if ($this->continuousBuffer) {
860	$this->decryptIV = $xor;
861	}
862	break;
863	case CRYPT_RIJNDAEL_MODE_CTR:
864	$xor = $this->decryptIV;
865	if (!empty($buffer['ciphertext'])) {
866	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
867	$block = substr($ciphertext, $i, $block_size);
868	$buffer['ciphertext'].= $this->_encryptBlock($this->_generate_xor($block_size, $xor));
869	$key = $this->_string_shift($buffer['ciphertext'], $block_size);
870	$plaintext.= $block ^ $key;
871	}
872	} else {
873	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
874	$block = substr($ciphertext, $i, $block_size);
875	$key = $this->_encryptBlock($this->_generate_xor($block_size, $xor));
876	$plaintext.= $block ^ $key;
877	}
878	}
879	if ($this->continuousBuffer) {
880	$this->decryptIV = $xor;
881	if ($start = strlen($ciphertext) % $block_size) {
882	$buffer['ciphertext'] = substr($key, $start) . $buffer['encrypted'];
883	}
884	}
885	break;
886	case CRYPT_RIJNDAEL_MODE_CFB:
887	if (!empty($buffer['ciphertext'])) {
888	$plaintext = $ciphertext ^ substr($this->decryptIV, strlen($buffer['ciphertext']));
889	$buffer['ciphertext'].= substr($ciphertext, 0, strlen($plaintext));
890	if (strlen($buffer['ciphertext']) == $block_size) {
891	$xor = $this->_encryptBlock($buffer['ciphertext']);
892	$buffer['ciphertext'] = '';
893	}
894	$start = strlen($plaintext);
895	$block = $this->decryptIV;
896	} else {
897	$plaintext = '';
898	$xor = $this->_encryptBlock($this->decryptIV);
899	$start = 0;
900	}
901
902	for ($i = $start; $i < strlen($ciphertext); $i+=$block_size) {
903	$block = substr($ciphertext, $i, $block_size);
904	$plaintext.= $block ^ $xor;
905	if ($continuousBuffer && strlen($block) != $block_size) {
906	$buffer['ciphertext'].= $block;
907	$block = $xor;
908	} else if (strlen($block) == $block_size) {
909	$xor = $this->_encryptBlock($block);
910	}
911	}
912	if ($this->continuousBuffer) {
913	$this->decryptIV = $block;
914	}
915	break;
916	case CRYPT_RIJNDAEL_MODE_OFB:
917	$xor = $this->decryptIV;
918	if (strlen($buffer)) {
919	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
920	$xor = $this->_encryptBlock($xor);
921	$buffer.= $xor;
922	$key = $this->_string_shift($buffer, $block_size);
923	$plaintext.= substr($ciphertext, $i, $block_size) ^ $key;
924	}
925	} else {
926	for ($i = 0; $i < strlen($ciphertext); $i+=$block_size) {
927	$xor = $this->_encryptBlock($xor);
928	$plaintext.= substr($ciphertext, $i, $block_size) ^ $xor;
929	}
930	$key = $xor;
931	}
932	if ($this->continuousBuffer) {
933	$this->decryptIV = $xor;
934	if ($start = strlen($ciphertext) % $block_size) {
935	$buffer = substr($key, $start) . $buffer;
936	}
937	}
938	}
939
940	return $this->paddable ? $this->_unpad($plaintext) : $plaintext;
941	}
942
943	/**
944	* Encrypts a block
945	*
946	* @access private
947	* @param String $in
948	* @return String
949	*/
950	function _encryptBlock($in)
951	{
952	$state = array();
953	$words = unpack('N*word', $in);
954
955	$w = $this->w;
956	$t0 = $this->t0;
957	$t1 = $this->t1;
958	$t2 = $this->t2;
959	$t3 = $this->t3;
960	$Nb = $this->Nb;
961	$Nr = $this->Nr;
962	$c = $this->c;
963
964	// addRoundKey
965	$i = 0;
966	foreach ($words as $word) {
967	$state[] = $word ^ $w[0][$i++];
968	}
969
970	// fips-197.pdf#page=19, "Figure 5. Pseudo Code for the Cipher", states that this loop has four components -
971	// subBytes, shiftRows, mixColumns, and addRoundKey. fips-197.pdf#page=30, "Implementation Suggestions Regarding
972	// Various Platforms" suggests that performs enhanced implementations are described in Rijndael-ammended.pdf.
973	// Rijndael-ammended.pdf#page=20, "Implementation aspects / 32-bit processor", discusses such an optimization.
974	// Unfortunately, the description given there is not quite correct. Per aes.spec.v316.pdf#page=19 [1],
975	// equation (7.4.7) is supposed to use addition instead of subtraction, so we'll do that here, as well.
976
977	// [1] http://fp.gladman.plus.com/cryptography_technology/rijndael/aes.spec.v316.pdf
978	$temp = array();
979	for ($round = 1; $round < $Nr; $round++) {
980	$i = 0; // $c[0] == 0
981	$j = $c[1];
982	$k = $c[2];
983	$l = $c[3];
984
985	while ($i < $this->Nb) {
986	$temp[$i] = $t0[$state[$i] & 0xFF000000] ^
987	$t1[$state[$j] & 0x00FF0000] ^
988	$t2[$state[$k] & 0x0000FF00] ^
989	$t3[$state[$l] & 0x000000FF] ^
990	$w[$round][$i];
991	$i++;
992	$j = ($j + 1) % $Nb;
993	$k = ($k + 1) % $Nb;
994	$l = ($l + 1) % $Nb;
995	}
996
997	for ($i = 0; $i < $Nb; $i++) {
998	$state[$i] = $temp[$i];
999	}
1000	}
1001
1002	// subWord
1003	for ($i = 0; $i < $Nb; $i++) {
1004	$state[$i] = $this->_subWord($state[$i]);
1005	}
1006
1007	// shiftRows + addRoundKey
1008	$i = 0; // $c[0] == 0
1009	$j = $c[1];
1010	$k = $c[2];
1011	$l = $c[3];
1012	while ($i < $this->Nb) {
1013	$temp[$i] = ($state[$i] & 0xFF000000) ^
1014	($state[$j] & 0x00FF0000) ^
1015	($state[$k] & 0x0000FF00) ^
1016	($state[$l] & 0x000000FF) ^
1017	$w[$Nr][$i];
1018	$i++;
1019	$j = ($j + 1) % $Nb;
1020	$k = ($k + 1) % $Nb;
1021	$l = ($l + 1) % $Nb;
1022	}
1023	$state = $temp;
1024
1025	array_unshift($state, 'N*');
1026
1027	return call_user_func_array('pack', $state);
1028	}
1029
1030	/**
1031	* Decrypts a block
1032	*
1033	* @access private
1034	* @param String $in
1035	* @return String
1036	*/
1037	function _decryptBlock($in)
1038	{
1039	$state = array();
1040	$words = unpack('N*word', $in);
1041
1042	$num_states = count($state);
1043	$dw = $this->dw;
1044	$dt0 = $this->dt0;
1045	$dt1 = $this->dt1;
1046	$dt2 = $this->dt2;
1047	$dt3 = $this->dt3;
1048	$Nb = $this->Nb;
1049	$Nr = $this->Nr;
1050	$c = $this->c;
1051
1052	// addRoundKey
1053	$i = 0;
1054	foreach ($words as $word) {
1055	$state[] = $word ^ $dw[$Nr][$i++];
1056	}
1057
1058	$temp = array();
1059	for ($round = $Nr - 1; $round > 0; $round--) {
1060	$i = 0; // $c[0] == 0
1061	$j = $Nb - $c[1];
1062	$k = $Nb - $c[2];
1063	$l = $Nb - $c[3];
1064
1065	while ($i < $Nb) {
1066	$temp[$i] = $dt0[$state[$i] & 0xFF000000] ^
1067	$dt1[$state[$j] & 0x00FF0000] ^
1068	$dt2[$state[$k] & 0x0000FF00] ^
1069	$dt3[$state[$l] & 0x000000FF] ^
1070	$dw[$round][$i];
1071	$i++;
1072	$j = ($j + 1) % $Nb;
1073	$k = ($k + 1) % $Nb;
1074	$l = ($l + 1) % $Nb;
1075	}
1076
1077	for ($i = 0; $i < $Nb; $i++) {
1078	$state[$i] = $temp[$i];
1079	}
1080	}
1081
1082	// invShiftRows + invSubWord + addRoundKey
1083	$i = 0; // $c[0] == 0
1084	$j = $Nb - $c[1];
1085	$k = $Nb - $c[2];
1086	$l = $Nb - $c[3];
1087
1088	while ($i < $Nb) {
1089	$temp[$i] = $dw[0][$i] ^
1090	$this->_invSubWord(($state[$i] & 0xFF000000) \|
1091	($state[$j] & 0x00FF0000) \|
1092	($state[$k] & 0x0000FF00) \|
1093	($state[$l] & 0x000000FF));
1094	$i++;
1095	$j = ($j + 1) % $Nb;
1096	$k = ($k + 1) % $Nb;
1097	$l = ($l + 1) % $Nb;
1098	}
1099
1100	$state = $temp;
1101
1102	array_unshift($state, 'N*');
1103
1104	return call_user_func_array('pack', $state);
1105	}
1106
1107	/**
1108	* Setup Rijndael
1109	*
1110	* Validates all the variables and calculates $Nr - the number of rounds that need to be performed - and $w - the key
1111	* key schedule.
1112	*
1113	* @access private
1114	*/
1115	function _setup()
1116	{
1117	// Each number in $rcon is equal to the previous number multiplied by two in Rijndael's finite field.
1118	// See http://en.wikipedia.org/wiki/Finite_field_arithmetic#Multiplicative_inverse
1119	static $rcon = array(0,
1120	0x01000000, 0x02000000, 0x04000000, 0x08000000, 0x10000000,
1121	0x20000000, 0x40000000, 0x80000000, 0x1B000000, 0x36000000,
1122	0x6C000000, 0xD8000000, 0xAB000000, 0x4D000000, 0x9A000000,
1123	0x2F000000, 0x5E000000, 0xBC000000, 0x63000000, 0xC6000000,
1124	0x97000000, 0x35000000, 0x6A000000, 0xD4000000, 0xB3000000,
1125	0x7D000000, 0xFA000000, 0xEF000000, 0xC5000000, 0x91000000
1126	);
1127
1128	if (!$this->changed) {
1129	return;
1130	}
1131
1132	if (!$this->explicit_key_length) {
1133	// we do >> 2, here, and not >> 5, as we do above, since strlen($this->key) tells us the number of bytes - not bits
1134	$length = strlen($this->key) >> 2;
1135	if ($length > 8) {
1136	$length = 8;
1137	} else if ($length < 4) {
1138	$length = 4;
1139	}
1140	$this->Nk = $length;
1141	$this->key_size = $length << 2;
1142	}
1143
1144	$this->key = str_pad(substr($this->key, 0, $this->key_size), $this->key_size, chr(0));
1145	$this->encryptIV = $this->decryptIV = $this->iv = str_pad(substr($this->iv, 0, $this->block_size), $this->block_size, chr(0));
1146
1147	// see Rijndael-ammended.pdf#page=44
1148	$this->Nr = max($this->Nk, $this->Nb) + 6;
1149
1150	// shift offsets for Nb = 5, 7 are defined in Rijndael-ammended.pdf#page=44,
1151	// "Table 8: Shift offsets in Shiftrow for the alternative block lengths"
1152	// shift offsets for Nb = 4, 6, 8 are defined in Rijndael-ammended.pdf#page=14,
1153	// "Table 2: Shift offsets for different block lengths"
1154	switch ($this->Nb) {
1155	case 4:
1156	case 5:
1157	case 6:
1158	$this->c = array(0, 1, 2, 3);
1159	break;
1160	case 7:
1161	$this->c = array(0, 1, 2, 4);
1162	break;
1163	case 8:
1164	$this->c = array(0, 1, 3, 4);
1165	}
1166
1167	$key = $this->key;
1168
1169	$w = array_values(unpack('N*words', $key));
1170
1171	$length = $this->Nb * ($this->Nr + 1);
1172	for ($i = $this->Nk; $i < $length; $i++) {
1173	$temp = $w[$i - 1];
1174	if ($i % $this->Nk == 0) {
1175	// according to <http://php.net/language.types.integer>, "the size of an integer is platform-dependent".
1176	// on a 32-bit machine, it's 32-bits, and on a 64-bit machine, it's 64-bits. on a 32-bit machine,
1177	// 0xFFFFFFFF << 8 == 0xFFFFFF00, but on a 64-bit machine, it equals 0xFFFFFFFF00. as such, doing 'and'
1178	// with 0xFFFFFFFF (or 0xFFFFFF00) on a 32-bit machine is unnecessary, but on a 64-bit machine, it is.
1179	$temp = (($temp << 8) & 0xFFFFFF00) \| (($temp >> 24) & 0x000000FF); // rotWord
1180	$temp = $this->_subWord($temp) ^ $rcon[$i / $this->Nk];
1181	} else if ($this->Nk > 6 && $i % $this->Nk == 4) {
1182	$temp = $this->_subWord($temp);
1183	}
1184	$w[$i] = $w[$i - $this->Nk] ^ $temp;
1185	}
1186
1187	// convert the key schedule from a vector of $Nb * ($Nr + 1) length to a matrix with $Nr + 1 rows and $Nb columns
1188	// and generate the inverse key schedule. more specifically,
1189	// according to <http://csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf#page=23> (section 5.3.3),
1190	// "The key expansion for the Inverse Cipher is defined as follows:
1191	// 1. Apply the Key Expansion.
1192	// 2. Apply InvMixColumn to all Round Keys except the first and the last one."
1193	// also, see fips-197.pdf#page=27, "5.3.5 Equivalent Inverse Cipher"
1194	$temp = array();
1195	for ($i = $row = $col = 0; $i < $length; $i++, $col++) {
1196	if ($col == $this->Nb) {
1197	if ($row == 0) {
1198	$this->dw[0] = $this->w[0];
1199	} else {
1200	// subWord + invMixColumn + invSubWord = invMixColumn
1201	$j = 0;
1202	while ($j < $this->Nb) {
1203	$dw = $this->_subWord($this->w[$row][$j]);
1204	$temp[$j] = $this->dt0[$dw & 0xFF000000] ^
1205	$this->dt1[$dw & 0x00FF0000] ^
1206	$this->dt2[$dw & 0x0000FF00] ^
1207	$this->dt3[$dw & 0x000000FF];
1208	$j++;
1209	}
1210	$this->dw[$row] = $temp;
1211	}
1212
1213	$col = 0;
1214	$row++;
1215	}
1216	$this->w[$row][$col] = $w[$i];
1217	}
1218
1219	$this->dw[$row] = $this->w[$row];
1220
1221	$this->changed = false;
1222	}
1223
1224	/**
1225	* Performs S-Box substitutions
1226	*
1227	* @access private
1228	*/
1229	function _subWord($word)
1230	{
1231	static $sbox0, $sbox1, $sbox2, $sbox3;
1232
1233	if (empty($sbox0)) {
1234	$sbox0 = array(
1235	0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
1236	0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
1237	0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
1238	0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
1239	0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
1240	0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
1241	0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
1242	0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
1243	0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
1244	0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
1245	0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
1246	0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
1247	0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
1248	0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
1249	0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
1250	0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
1251	);
1252
1253	$sbox1 = array();
1254	$sbox2 = array();
1255	$sbox3 = array();
1256
1257	for ($i = 0; $i < 256; $i++) {
1258	$sbox1[$i << 8] = $sbox0[$i] << 8;
1259	$sbox2[$i << 16] = $sbox0[$i] << 16;
1260	$sbox3[$i << 24] = $sbox0[$i] << 24;
1261	}
1262	}
1263
1264	return $sbox0[$word & 0x000000FF] \|
1265	$sbox1[$word & 0x0000FF00] \|
1266	$sbox2[$word & 0x00FF0000] \|
1267	$sbox3[$word & 0xFF000000];
1268	}
1269
1270	/**
1271	* Performs inverse S-Box substitutions
1272	*
1273	* @access private
1274	*/
1275	function _invSubWord($word)
1276	{
1277	static $sbox0, $sbox1, $sbox2, $sbox3;
1278
1279	if (empty($sbox0)) {
1280	$sbox0 = array(
1281	0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
1282	0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
1283	0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
1284	0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
1285	0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
1286	0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
1287	0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
1288	0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
1289	0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
1290	0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
1291	0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
1292	0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
1293	0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
1294	0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
1295	0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
1296	0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
1297	);
1298
1299	$sbox1 = array();
1300	$sbox2 = array();
1301	$sbox3 = array();
1302
1303	for ($i = 0; $i < 256; $i++) {
1304	$sbox1[$i << 8] = $sbox0[$i] << 8;
1305	$sbox2[$i << 16] = $sbox0[$i] << 16;
1306	$sbox3[$i << 24] = $sbox0[$i] << 24;
1307	}
1308	}
1309
1310	return $sbox0[$word & 0x000000FF] \|
1311	$sbox1[$word & 0x0000FF00] \|
1312	$sbox2[$word & 0x00FF0000] \|
1313	$sbox3[$word & 0xFF000000];
1314	}
1315
1316	/**
1317	* Pad "packets".
1318	*
1319	* Rijndael works by encrypting between sixteen and thirty-two bytes at a time, provided that number is also a multiple
1320	* of four. If you ever need to encrypt or decrypt something that isn't of the proper length, it becomes necessary to
1321	* pad the input so that it is of the proper length.
1322	*
1323	* Padding is enabled by default. Sometimes, however, it is undesirable to pad strings. Such is the case in SSH,
1324	* where "packets" are padded with random bytes before being encrypted. Unpad these packets and you risk stripping
1325	* away characters that shouldn't be stripped away. (SSH knows how many bytes are added because the length is
1326	* transmitted separately)
1327	*
1328	* @see Crypt_Rijndael::disablePadding()
1329	* @access public
1330	*/
1331	function enablePadding()
1332	{
1333	$this->padding = true;
1334	}
1335
1336	/**
1337	* Do not pad packets.
1338	*
1339	* @see Crypt_Rijndael::enablePadding()
1340	* @access public
1341	*/
1342	function disablePadding()
1343	{
1344	$this->padding = false;
1345	}
1346
1347	/**
1348	* Pads a string
1349	*
1350	* Pads a string using the RSA PKCS padding standards so that its length is a multiple of the blocksize.
1351	* $block_size - (strlen($text) % $block_size) bytes are added, each of which is equal to
1352	* chr($block_size - (strlen($text) % $block_size)
1353	*
1354	* If padding is disabled and $text is not a multiple of the blocksize, the string will be padded regardless
1355	* and padding will, hence forth, be enabled.
1356	*
1357	* @see Crypt_Rijndael::_unpad()
1358	* @access private
1359	*/
1360	function _pad($text)
1361	{
1362	$length = strlen($text);
1363
1364	if (!$this->padding) {
1365	if ($length % $this->block_size == 0) {
1366	return $text;
1367	} else {
1368	user_error("The plaintext's length ($length) is not a multiple of the block size ({$this->block_size})", E_USER_NOTICE);
1369	$this->padding = true;
1370	}
1371	}
1372
1373	$pad = $this->block_size - ($length % $this->block_size);
1374
1375	return str_pad($text, $length + $pad, chr($pad));
1376	}
1377
1378	/**
1379	* Unpads a string.
1380	*
1381	* If padding is enabled and the reported padding length is invalid the encryption key will be assumed to be wrong
1382	* and false will be returned.
1383	*
1384	* @see Crypt_Rijndael::_pad()
1385	* @access private
1386	*/
1387	function _unpad($text)
1388	{
1389	if (!$this->padding) {
1390	return $text;
1391	}
1392
1393	$length = ord($text[strlen($text) - 1]);
1394
1395	if (!$length \|\| $length > $this->block_size) {
1396	return false;
1397	}
1398
1399	return substr($text, 0, -$length);
1400	}
1401
1402	/**
1403	* Treat consecutive "packets" as if they are a continuous buffer.
1404	*
1405	* Say you have a 32-byte plaintext $plaintext. Using the default behavior, the two following code snippets
1406	* will yield different outputs:
1407	*
1408	* <code>
1409	* echo $rijndael->encrypt(substr($plaintext, 0, 16));
1410	* echo $rijndael->encrypt(substr($plaintext, 16, 16));
1411	* </code>
1412	* <code>
1413	* echo $rijndael->encrypt($plaintext);
1414	* </code>
1415	*
1416	* The solution is to enable the continuous buffer. Although this will resolve the above discrepancy, it creates
1417	* another, as demonstrated with the following:
1418	*
1419	* <code>
1420	* $rijndael->encrypt(substr($plaintext, 0, 16));
1421	* echo $rijndael->decrypt($des->encrypt(substr($plaintext, 16, 16)));
1422	* </code>
1423	* <code>
1424	* echo $rijndael->decrypt($des->encrypt(substr($plaintext, 16, 16)));
1425	* </code>
1426	*
1427	* With the continuous buffer disabled, these would yield the same output. With it enabled, they yield different
1428	* outputs. The reason is due to the fact that the initialization vector's change after every encryption /
1429	* decryption round when the continuous buffer is enabled. When it's disabled, they remain constant.
1430	*
1431	* Put another way, when the continuous buffer is enabled, the state of the Crypt_Rijndael() object changes after each
1432	* encryption / decryption round, whereas otherwise, it'd remain constant. For this reason, it's recommended that
1433	* continuous buffers not be used. They do offer better security and are, in fact, sometimes required (SSH uses them),
1434	* however, they are also less intuitive and more likely to cause you problems.
1435	*
1436	* @see Crypt_Rijndael::disableContinuousBuffer()
1437	* @access public
1438	*/
1439	function enableContinuousBuffer()
1440	{
1441	$this->continuousBuffer = true;
1442	}
1443
1444	/**
1445	* Treat consecutive packets as if they are a discontinuous buffer.
1446	*
1447	* The default behavior.
1448	*
1449	* @see Crypt_Rijndael::enableContinuousBuffer()
1450	* @access public
1451	*/
1452	function disableContinuousBuffer()
1453	{
1454	$this->continuousBuffer = false;
1455	$this->encryptIV = $this->iv;
1456	$this->decryptIV = $this->iv;
1457	}
1458
1459	/**
1460	* String Shift
1461	*
1462	* Inspired by array_shift
1463	*
1464	* @param String $string
1465	* @param optional Integer $index
1466	* @return String
1467	* @access private
1468	*/
1469	function _string_shift(&$string, $index = 1)
1470	{
1471	$substr = substr($string, 0, $index);
1472	$string = substr($string, $index);
1473	return $substr;
1474	}
1475	}
1476
1477	// vim: ts=4:sw=4:et:
1478	// vim6: fdl=1:
1479