randombit / botan / 11087146043

void AES_SBOX(uint32_t V[8]) {

   const uint32_t U0 = V[0];

   const uint32_t U1 = V[1];

   const uint32_t U2 = V[2];

   const uint32_t U3 = V[3];

   const uint32_t U4 = V[4];

   const uint32_t U5 = V[5];

   const uint32_t U6 = V[6];

   const uint32_t U7 = V[7];

   const uint32_t y14 = U3 ^ U5;

   const uint32_t y13 = U0 ^ U6;

   const uint32_t y9 = U0 ^ U3;

   const uint32_t y8 = U0 ^ U5;

   const uint32_t t0 = U1 ^ U2;

   const uint32_t y1 = t0 ^ U7;

   const uint32_t y4 = y1 ^ U3;

   const uint32_t y12 = y13 ^ y14;

   const uint32_t y2 = y1 ^ U0;

   const uint32_t y5 = y1 ^ U6;

   const uint32_t y3 = y5 ^ y8;

   const uint32_t t1 = U4 ^ y12;

   const uint32_t y15 = t1 ^ U5;

   const uint32_t y20 = t1 ^ U1;

   const uint32_t y6 = y15 ^ U7;

   const uint32_t y10 = y15 ^ t0;

   const uint32_t y11 = y20 ^ y9;

   const uint32_t y7 = U7 ^ y11;

   const uint32_t y17 = y10 ^ y11;

   const uint32_t y19 = y10 ^ y8;

   const uint32_t y16 = t0 ^ y11;

   const uint32_t y21 = y13 ^ y16;

   const uint32_t y18 = U0 ^ y16;

   const uint32_t t2 = y12 & y15;

   const uint32_t t3 = y3 & y6;

   const uint32_t t4 = t3 ^ t2;

   const uint32_t t5 = y4 & U7;

   const uint32_t t6 = t5 ^ t2;

   const uint32_t t7 = y13 & y16;

   const uint32_t t8 = y5 & y1;

   const uint32_t t9 = t8 ^ t7;

   const uint32_t t10 = y2 & y7;

   const uint32_t t11 = t10 ^ t7;

   const uint32_t t12 = y9 & y11;

   const uint32_t t13 = y14 & y17;

   const uint32_t t14 = t13 ^ t12;

   const uint32_t t15 = y8 & y10;

   const uint32_t t16 = t15 ^ t12;

   const uint32_t t17 = t4 ^ y20;

   const uint32_t t18 = t6 ^ t16;

   const uint32_t t19 = t9 ^ t14;

   const uint32_t t20 = t11 ^ t16;

   const uint32_t t21 = t17 ^ t14;

   const uint32_t t22 = t18 ^ y19;

   const uint32_t t23 = t19 ^ y21;

   const uint32_t t24 = t20 ^ y18;

   const uint32_t t25 = t21 ^ t22;

   const uint32_t t26 = t21 & t23;

   const uint32_t t27 = t24 ^ t26;

   const uint32_t t28 = t25 & t27;

   const uint32_t t29 = t28 ^ t22;

   const uint32_t t30 = t23 ^ t24;

   const uint32_t t31 = t22 ^ t26;

   const uint32_t t32 = t31 & t30;

   const uint32_t t33 = t32 ^ t24;

   const uint32_t t34 = t23 ^ t33;

   const uint32_t t35 = t27 ^ t33;

   const uint32_t t36 = t24 & t35;

   const uint32_t t37 = t36 ^ t34;

   const uint32_t t38 = t27 ^ t36;

   const uint32_t t39 = t29 & t38;

   const uint32_t t40 = t25 ^ t39;

   const uint32_t t41 = t40 ^ t37;

   const uint32_t t42 = t29 ^ t33;

   const uint32_t t43 = t29 ^ t40;

   const uint32_t t44 = t33 ^ t37;

   const uint32_t t45 = t42 ^ t41;

   const uint32_t z0 = t44 & y15;

   const uint32_t z1 = t37 & y6;

   const uint32_t z2 = t33 & U7;

   const uint32_t z3 = t43 & y16;

   const uint32_t z4 = t40 & y1;

   const uint32_t z5 = t29 & y7;

   const uint32_t z6 = t42 & y11;

   const uint32_t z7 = t45 & y17;

   const uint32_t z8 = t41 & y10;

   const uint32_t z9 = t44 & y12;

   const uint32_t z10 = t37 & y3;

   const uint32_t z11 = t33 & y4;

   const uint32_t z12 = t43 & y13;

   const uint32_t z13 = t40 & y5;

   const uint32_t z14 = t29 & y2;

   const uint32_t z15 = t42 & y9;

   const uint32_t z16 = t45 & y14;

   const uint32_t z17 = t41 & y8;

   const uint32_t tc1 = z15 ^ z16;

   const uint32_t tc2 = z10 ^ tc1;

   const uint32_t tc3 = z9 ^ tc2;

   const uint32_t tc4 = z0 ^ z2;

   const uint32_t tc5 = z1 ^ z0;

   const uint32_t tc6 = z3 ^ z4;

   const uint32_t tc7 = z12 ^ tc4;

   const uint32_t tc8 = z7 ^ tc6;

   const uint32_t tc9 = z8 ^ tc7;

   const uint32_t tc10 = tc8 ^ tc9;

   const uint32_t tc11 = tc6 ^ tc5;

   const uint32_t tc12 = z3 ^ z5;

   const uint32_t tc13 = z13 ^ tc1;

   const uint32_t tc14 = tc4 ^ tc12;

   const uint32_t S3 = tc3 ^ tc11;

   const uint32_t tc16 = z6 ^ tc8;

   const uint32_t tc17 = z14 ^ tc10;

   const uint32_t tc18 = ~tc13 ^ tc14;

   const uint32_t S7 = z12 ^ tc18;

   const uint32_t tc20 = z15 ^ tc16;

   const uint32_t tc21 = tc2 ^ z11;

   const uint32_t S0 = tc3 ^ tc16;

   const uint32_t S6 = tc10 ^ tc18;

   const uint32_t S4 = tc14 ^ S3;

   const uint32_t S1 = ~(S3 ^ tc16);

   const uint32_t tc26 = tc17 ^ tc20;

   const uint32_t S2 = ~(tc26 ^ z17);

   const uint32_t S5 = tc21 ^ tc17;

   V[0] = S0;

   V[1] = S1;

   V[2] = S2;

   V[3] = S3;

   V[4] = S4;

   V[5] = S5;

   V[6] = S6;

   V[7] = S7;

}

void AES_INV_SBOX(uint32_t V[8]) {

   const uint32_t U0 = V[0];

   const uint32_t U1 = V[1];

   const uint32_t U2 = V[2];

   const uint32_t U3 = V[3];

   const uint32_t U4 = V[4];

   const uint32_t U5 = V[5];

   const uint32_t U6 = V[6];

   const uint32_t U7 = V[7];

   const uint32_t Y0 = U0 ^ U3;

   const uint32_t Y2 = ~(U1 ^ U3);

   const uint32_t Y4 = U0 ^ Y2;

   const uint32_t RTL0 = U6 ^ U7;

   const uint32_t Y1 = Y2 ^ RTL0;

   const uint32_t Y7 = ~(U2 ^ Y1);

   const uint32_t RTL1 = U3 ^ U4;

   const uint32_t Y6 = ~(U7 ^ RTL1);

   const uint32_t Y3 = Y1 ^ RTL1;

   const uint32_t RTL2 = ~(U0 ^ U2);

   const uint32_t Y5 = U5 ^ RTL2;

   const uint32_t sa1 = Y0 ^ Y2;

   const uint32_t sa0 = Y1 ^ Y3;

   const uint32_t sb1 = Y4 ^ Y6;

   const uint32_t sb0 = Y5 ^ Y7;

   const uint32_t ah = Y0 ^ Y1;

   const uint32_t al = Y2 ^ Y3;

   const uint32_t aa = sa0 ^ sa1;

   const uint32_t bh = Y4 ^ Y5;

   const uint32_t bl = Y6 ^ Y7;

   const uint32_t bb = sb0 ^ sb1;

   const uint32_t ab20 = sa0 ^ sb0;

   const uint32_t ab22 = al ^ bl;

   const uint32_t ab23 = Y3 ^ Y7;

   const uint32_t ab21 = sa1 ^ sb1;

   const uint32_t abcd1 = ah & bh;

   const uint32_t rr1 = Y0 & Y4;

   const uint32_t ph11 = ab20 ^ abcd1;

   const uint32_t t01 = Y1 & Y5;

   const uint32_t ph01 = t01 ^ abcd1;

   const uint32_t abcd2 = al & bl;

   const uint32_t r1 = Y2 & Y6;

   const uint32_t pl11 = ab22 ^ abcd2;

   const uint32_t r2 = Y3 & Y7;

   const uint32_t pl01 = r2 ^ abcd2;

   const uint32_t r3 = sa0 & sb0;

   const uint32_t vr1 = aa & bb;

   const uint32_t pr1 = vr1 ^ r3;

   const uint32_t wr1 = sa1 & sb1;

   const uint32_t qr1 = wr1 ^ r3;

   const uint32_t ab0 = ph11 ^ rr1;

   const uint32_t ab1 = ph01 ^ ab21;

   const uint32_t ab2 = pl11 ^ r1;

   const uint32_t ab3 = pl01 ^ qr1;

   const uint32_t cp1 = ab0 ^ pr1;

   const uint32_t cp2 = ab1 ^ qr1;

   const uint32_t cp3 = ab2 ^ pr1;

   const uint32_t cp4 = ab3 ^ ab23;

   const uint32_t tinv1 = cp3 ^ cp4;

   const uint32_t tinv2 = cp3 & cp1;

   const uint32_t tinv3 = cp2 ^ tinv2;

   const uint32_t tinv4 = cp1 ^ cp2;

   const uint32_t tinv5 = cp4 ^ tinv2;

   const uint32_t tinv6 = tinv5 & tinv4;

   const uint32_t tinv7 = tinv3 & tinv1;

   const uint32_t d2 = cp4 ^ tinv7;

   const uint32_t d0 = cp2 ^ tinv6;

   const uint32_t tinv8 = cp1 & cp4;

   const uint32_t tinv9 = tinv4 & tinv8;

   const uint32_t tinv10 = tinv4 ^ tinv2;

   const uint32_t d1 = tinv9 ^ tinv10;

   const uint32_t tinv11 = cp2 & cp3;

   const uint32_t tinv12 = tinv1 & tinv11;

   const uint32_t tinv13 = tinv1 ^ tinv2;

   const uint32_t d3 = tinv12 ^ tinv13;

   const uint32_t sd1 = d1 ^ d3;

   const uint32_t sd0 = d0 ^ d2;

   const uint32_t dl = d0 ^ d1;

   const uint32_t dh = d2 ^ d3;

   const uint32_t dd = sd0 ^ sd1;

   const uint32_t abcd3 = dh & bh;

   const uint32_t rr2 = d3 & Y4;

   const uint32_t t02 = d2 & Y5;

   const uint32_t abcd4 = dl & bl;

   const uint32_t r4 = d1 & Y6;

   const uint32_t r5 = d0 & Y7;

   const uint32_t r6 = sd0 & sb0;

   const uint32_t vr2 = dd & bb;

   const uint32_t wr2 = sd1 & sb1;

   const uint32_t abcd5 = dh & ah;

   const uint32_t r7 = d3 & Y0;

   const uint32_t r8 = d2 & Y1;

   const uint32_t abcd6 = dl & al;

   const uint32_t r9 = d1 & Y2;

   const uint32_t r10 = d0 & Y3;

   const uint32_t r11 = sd0 & sa0;

   const uint32_t vr3 = dd & aa;

   const uint32_t wr3 = sd1 & sa1;

   const uint32_t ph12 = rr2 ^ abcd3;

   const uint32_t ph02 = t02 ^ abcd3;

   const uint32_t pl12 = r4 ^ abcd4;

   const uint32_t pl02 = r5 ^ abcd4;

   const uint32_t pr2 = vr2 ^ r6;

   const uint32_t qr2 = wr2 ^ r6;

   const uint32_t p0 = ph12 ^ pr2;

   const uint32_t p1 = ph02 ^ qr2;

   const uint32_t p2 = pl12 ^ pr2;

   const uint32_t p3 = pl02 ^ qr2;

   const uint32_t ph13 = r7 ^ abcd5;

   const uint32_t ph03 = r8 ^ abcd5;

   const uint32_t pl13 = r9 ^ abcd6;

   const uint32_t pl03 = r10 ^ abcd6;

   const uint32_t pr3 = vr3 ^ r11;

   const uint32_t qr3 = wr3 ^ r11;

   const uint32_t p4 = ph13 ^ pr3;

   const uint32_t S7 = ph03 ^ qr3;

   const uint32_t p6 = pl13 ^ pr3;

   const uint32_t p7 = pl03 ^ qr3;

   const uint32_t S3 = p1 ^ p6;

   const uint32_t S6 = p2 ^ p6;

   const uint32_t S0 = p3 ^ p6;

   const uint32_t X11 = p0 ^ p2;

   const uint32_t S5 = S0 ^ X11;

   const uint32_t X13 = p4 ^ p7;

   const uint32_t X14 = X11 ^ X13;

   const uint32_t S1 = S3 ^ X14;

   const uint32_t X16 = p1 ^ S7;

   const uint32_t S2 = X14 ^ X16;

   const uint32_t X18 = p0 ^ p4;

   const uint32_t X19 = S5 ^ X16;

   const uint32_t S4 = X18 ^ X19;

   V[0] = S0;

   V[1] = S1;

   V[2] = S2;

   V[3] = S3;

   V[4] = S4;

   V[5] = S5;

   V[6] = S6;

   V[7] = S7;

}

inline void bit_transpose(uint32_t B[8]) {

   swap_bits<uint32_t>(B[1], B[0], 0x55555555, 1);

   swap_bits<uint32_t>(B[3], B[2], 0x55555555, 1);

   swap_bits<uint32_t>(B[5], B[4], 0x55555555, 1);

   swap_bits<uint32_t>(B[7], B[6], 0x55555555, 1);

   swap_bits<uint32_t>(B[2], B[0], 0x33333333, 2);

   swap_bits<uint32_t>(B[3], B[1], 0x33333333, 2);

   swap_bits<uint32_t>(B[6], B[4], 0x33333333, 2);

   swap_bits<uint32_t>(B[7], B[5], 0x33333333, 2);

   swap_bits<uint32_t>(B[4], B[0], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[5], B[1], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[6], B[2], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[7], B[3], 0x0F0F0F0F, 4);

}

inline void ks_expand(uint32_t B[8], const uint32_t K[], size_t r) {

   for(size_t i = 0; i != 4; ++i) {

      B[i] = K[r + i];

   swap_bits<uint32_t>(B[1], B[0], 0x55555555, 1);

   swap_bits<uint32_t>(B[3], B[2], 0x55555555, 1);

   swap_bits<uint32_t>(B[2], B[0], 0x33333333, 2);

   swap_bits<uint32_t>(B[3], B[1], 0x33333333, 2);

   B[4] = B[0];

   B[5] = B[1];

   B[6] = B[2];

   B[7] = B[3];

   swap_bits<uint32_t>(B[4], B[0], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[5], B[1], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[6], B[2], 0x0F0F0F0F, 4);

   swap_bits<uint32_t>(B[7], B[3], 0x0F0F0F0F, 4);

}

inline void shift_rows(uint32_t B[8]) {

   for(size_t i = 0; i != 8; i += 2) {

      uint64_t x = (static_cast<uint64_t>(B[i]) << 32) | B[i + 1];

      x = bit_permute_step<uint64_t>(x, 0x0022331100223311, 2);

      x = bit_permute_step<uint64_t>(x, 0x0055005500550055, 1);

      B[i] = static_cast<uint32_t>(x >> 32);

      B[i + 1] = static_cast<uint32_t>(x);

}

inline void inv_shift_rows(uint32_t B[8]) {

   for(size_t i = 0; i != 8; i += 2) {

      uint64_t x = (static_cast<uint64_t>(B[i]) << 32) | B[i + 1];

      x = bit_permute_step<uint64_t>(x, 0x0055005500550055, 1);

      x = bit_permute_step<uint64_t>(x, 0x0022331100223311, 2);

      B[i] = static_cast<uint32_t>(x >> 32);

      B[i + 1] = static_cast<uint32_t>(x);

}

inline void mix_columns(uint32_t B[8]) {

   const uint32_t X2[8] = {

      B[4] ^ B[0],

      B[5] ^ B[0],

      B[7] ^ B[0],

   };

   for(size_t i = 0; i != 8; i++) {

      const uint32_t X3 = B[i] ^ X2[i];

      B[i] = X2[i] ^ rotr<8>(B[i]) ^ rotr<16>(B[i]) ^ rotr<24>(X3);

}

void inv_mix_columns(uint32_t B[8]) {

   const uint32_t X4[8] = {

      B[4] ^ B[0],

      B[5] ^ B[0] ^ B[1],

      B[6] ^ B[1],

      B[7] ^ B[0],

      B[0] ^ B[1],

   };

   for(size_t i = 0; i != 8; i++) {

      const uint32_t X5 = X4[i] ^ B[i];

      B[i] = X5 ^ rotr<16>(X4[i]);

   mix_columns(B);

}

void aes_encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks, const secure_vector<uint32_t>& EK) {

   BOTAN_ASSERT(EK.size() == 44 || EK.size() == 52 || EK.size() == 60, "Key was set");

   const size_t rounds = (EK.size() - 4) / 4;

   uint32_t KS[13 * 8] = {0};  // actual maximum is (rounds - 1) * 8

   for(size_t i = 0; i < rounds - 1; i += 1) {

      ks_expand(&KS[8 * i], EK.data(), 4 * i + 4);

   const size_t BLOCK_SIZE = 16;

   const size_t BITSLICED_BLOCKS = 8 * sizeof(uint32_t) / BLOCK_SIZE;

   while(blocks > 0) {

      const size_t this_loop = std::min(blocks, BITSLICED_BLOCKS);

      uint32_t B[8] = {0};

      load_be(B, in, this_loop * 4);

      CT::poison(B, 8);

      for(size_t i = 0; i != 8; ++i) {

         B[i] ^= EK[i % 4];

      bit_transpose(B);

      for(size_t r = 0; r != rounds - 1; ++r) {

         AES_SBOX(B);

         shift_rows(B);

         mix_columns(B);

         for(size_t i = 0; i != 8; ++i) {

            B[i] ^= KS[8 * r + i];

      AES_SBOX(B);

      shift_rows(B);

      bit_transpose(B);

      for(size_t i = 0; i != 8; ++i) {

         B[i] ^= EK[4 * rounds + i % 4];

      CT::unpoison(B, 8);

      copy_out_be(std::span(out, this_loop * 4 * sizeof(uint32_t)), B);

      in += this_loop * BLOCK_SIZE;

      out += this_loop * BLOCK_SIZE;

      blocks -= this_loop;

}

void aes_decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks, const secure_vector<uint32_t>& DK) {

   BOTAN_ASSERT(DK.size() == 44 || DK.size() == 52 || DK.size() == 60, "Key was set");

   const size_t rounds = (DK.size() - 4) / 4;

   uint32_t KS[13 * 8] = {0};  // actual maximum is (rounds - 1) * 8

   for(size_t i = 0; i < rounds - 1; i += 1) {

      ks_expand(&KS[8 * i], DK.data(), 4 * i + 4);

   const size_t BLOCK_SIZE = 16;

   const size_t BITSLICED_BLOCKS = 8 * sizeof(uint32_t) / BLOCK_SIZE;

   while(blocks > 0) {

      const size_t this_loop = std::min(blocks, BITSLICED_BLOCKS);

      uint32_t B[8] = {0};

      CT::poison(B, 8);

      load_be(B, in, this_loop * 4);

      for(size_t i = 0; i != 8; ++i) {

         B[i] ^= DK[i % 4];

      bit_transpose(B);

      for(size_t r = 0; r != rounds - 1; ++r) {

         AES_INV_SBOX(B);

         inv_shift_rows(B);

         inv_mix_columns(B);

         for(size_t i = 0; i != 8; ++i) {

            B[i] ^= KS[8 * r + i];

      AES_INV_SBOX(B);

      inv_shift_rows(B);

      bit_transpose(B);

      for(size_t i = 0; i != 8; ++i) {

         B[i] ^= DK[4 * rounds + i % 4];

      CT::unpoison(B, 8);

      copy_out_be(std::span(out, this_loop * 4 * sizeof(uint32_t)), B);

      in += this_loop * BLOCK_SIZE;

      out += this_loop * BLOCK_SIZE;

      blocks -= this_loop;

}

inline uint32_t xtime32(uint32_t s) {

   const uint32_t lo_bit = 0x01010101;

   const uint32_t mask = 0x7F7F7F7F;

   const uint32_t poly = 0x1B;

   return ((s & mask) << 1) ^ (((s >> 7) & lo_bit) * poly);

inline uint32_t InvMixColumn(uint32_t s1) {

   const uint32_t s2 = xtime32(s1);

   const uint32_t s4 = xtime32(s2);

   const uint32_t s8 = xtime32(s4);

   const uint32_t s9 = s8 ^ s1;

   const uint32_t s11 = s9 ^ s2;

   const uint32_t s13 = s9 ^ s4;

   const uint32_t s14 = s8 ^ s4 ^ s2;

   return s14 ^ rotr<8>(s9) ^ rotr<16>(s13) ^ rotr<24>(s11);

void InvMixColumn_x4(uint32_t x[4]) {

   x[0] = InvMixColumn(x[0]);

   x[1] = InvMixColumn(x[1]);

   x[2] = InvMixColumn(x[2]);

   x[3] = InvMixColumn(x[3]);

}

uint32_t SE_word(uint32_t x) {

   uint32_t I[8] = {0};

   for(size_t i = 0; i != 8; ++i) {

      I[i] = (x >> (7 - i)) & 0x01010101;

   AES_SBOX(I);

   x = 0;

   for(size_t i = 0; i != 8; ++i) {

      x |= ((I[i] & 0x01010101) << (7 - i));

   return x;

void aes_key_schedule(const uint8_t key[],

   static const uint32_t RC[10] = {0x01000000,

   const size_t X = length / 4;

   BOTAN_ASSERT_NOMSG(X == 4 || X == 6 || X == 8);

   const size_t rounds = (length / 4) + 6;

   BOTAN_ASSERT_NOMSG(rounds == 10 || rounds == 12 || rounds == 14);

   CT::poison(key, length);

   EK.resize(length + 28);

   DK.resize(length + 28);

   for(size_t i = 0; i != X; ++i) {

      EK[i] = load_be<uint32_t>(key, i);

   for(size_t i = X; i < 4 * (rounds + 1); i += X) {

      EK[i] = EK[i - X] ^ RC[(i - X) / X] ^ rotl<8>(SE_word(EK[i - 1]));

      for(size_t j = 1; j != X && (i + j) < EK.size(); ++j) {

         EK[i + j] = EK[i + j - X];

         if(X == 8 && j == 4) {

            EK[i + j] ^= SE_word(EK[i + j - 1]);

            EK[i + j] ^= EK[i + j - 1];

   for(size_t i = 0; i != 4 * (rounds + 1); i += 4) {

      DK[i] = EK[4 * rounds - i];

      DK[i + 1] = EK[4 * rounds - i + 1];

      DK[i + 2] = EK[4 * rounds - i + 2];

      DK[i + 3] = EK[4 * rounds - i + 3];

   for(size_t i = 4; i != 4 * rounds; i += 4) {

      InvMixColumn_x4(&DK[i]);

   if(bswap_keys) {

   CT::unpoison(EK.data(), EK.size());

   CT::unpoison(DK.data(), DK.size());

   CT::unpoison(key, length);

}

size_t aes_parallelism() {

   if(CPUID::has_hw_aes()) {

   if(CPUID::has_vperm()) {

const char* aes_provider() {

   if(CPUID::has_hw_aes()) {

   if(CPUID::has_vperm()) {

      return "vperm";

std::string AES_128::provider() const {

   return aes_provider();

std::string AES_192::provider() const {

   return aes_provider();

std::string AES_256::provider() const {

   return aes_provider();

size_t AES_128::parallelism() const {

   return aes_parallelism();

size_t AES_192::parallelism() const {

   return aes_parallelism();

size_t AES_256::parallelism() const {

   return aes_parallelism();

bool AES_128::has_keying_material() const {

   return !m_EK.empty();

bool AES_192::has_keying_material() const {

   return !m_EK.empty();

bool AES_256::has_keying_material() const {

   return !m_EK.empty();

void AES_128::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {

   assert_key_material_set();

   if(CPUID::has_hw_aes()) {

      return hw_aes_encrypt_n(in, out, blocks);

   if(CPUID::has_vperm()) {

      return vperm_encrypt_n(in, out, blocks);

   aes_encrypt_n(in, out, blocks, m_EK);

void AES_128::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {

   assert_key_material_set();

   if(CPUID::has_hw_aes()) {

      return hw_aes_decrypt_n(in, out, blocks);

   if(CPUID::has_vperm()) {

      return vperm_decrypt_n(in, out, blocks);

   aes_decrypt_n(in, out, blocks, m_DK);

void AES_128::key_schedule(std::span<const uint8_t> key) {

   if(CPUID::has_aes_ni()) {

      return aesni_key_schedule(key.data(), key.size());

   if(CPUID::has_hw_aes()) {

   if(CPUID::has_vperm()) {

      return vperm_key_schedule(key.data(), key.size());

   aes_key_schedule(key.data(), key.size(), m_EK, m_DK);

void AES_128::clear() {

   zap(m_EK);

   zap(m_DK);

}

void AES_192::encrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {

   assert_key_material_set();

   if(CPUID::has_hw_aes()) {

      return hw_aes_encrypt_n(in, out, blocks);

   if(CPUID::has_vperm()) {

      return vperm_encrypt_n(in, out, blocks);

   aes_encrypt_n(in, out, blocks, m_EK);

void AES_192::decrypt_n(const uint8_t in[], uint8_t out[], size_t blocks) const {

   assert_key_material_set();

   if(CPUID::has_hw_aes()) {

      return hw_aes_decrypt_n(in, out, blocks);

   if(CPUID::has_vperm()) {

      return vperm_decrypt_n(in, out, blocks);

   aes_decrypt_n(in, out, blocks, m_DK);

void AES_192::key_schedule(std::span<const uint8_t> key) {

   if(CPUID::has_aes_ni()) {

      return aesni_key_schedule(key.data(), key.size());

   if(CPUID::has_hw_aes()) {

   if(CPUID::has_vperm()) {

      return vperm_key_schedule(key.data(), key.size());

   aes_key_schedule(key.data(), key.size(), m_EK, m_DK);