toy-aes.go

package main

import "fmt"
import "os"
import "encoding/base64"

// ----- KEY EXPANSION -----

var blockwidth int

func keyexpansion(key []byte) [][]byte {
	// key expansion for the three sizes of AES: 128/192/256.
	// we need discrete key material for each round that occurs.
	// this will expand our n-bit key to a key of length (block width * rounds)
	// we perform varied operations on words of 4 bytes.
	var keylen, expandedlen, iter int
	var expandedkey, t []byte
	blockwidth = 16 // AES requires 16, but this is tunable for use as Rijndael
	// the 'expandedlen' vars below can be considered tunable;
	// provided they are multiples of the block width, they define the number of rounds
	if len(key) == 16 { // AES-128
		keylen = 16
		expandedlen = 176
	} else if len(key) == 24 { // AES-192
		keylen = 24
		expandedlen = 208
	} else if len(key) == 32 { // AES-256
		keylen = 32
		expandedlen = 240
	} else {
		fmt.Println("[!] Invalid key length (not 128, 192, or 256 bits)")
		os.Exit(1)
	}
	if expandedlen%blockwidth != 0 {
		fmt.Println("[!] Invalid key schedule tuning - output length must be a multiple of block width")
	}
	iter = 1          // iteration count for feeding rcon()
	expandedkey = key // the first $keylen bytes of the expanded key are simply the original key
	keybytes := keylen
	for keybytes < expandedlen {
		pos := len(expandedkey)
		t = expandedkey[pos-4 : pos] // t is set to the previous 4 bytes of the expanded key
		if pos%keylen == 0 {         // every $keylen/4 words get special processing
			t = keyschedcore(t, iter) // and the special processing is keyschedscore (see below)
			iter += 1
		}
		if keylen == 32 { // if AES-256:
			if pos%keylen == keylen/2 { // words lining up halfway through $keylen (e.g. 48, 80, 112)
				t = SubBytes(t, "forward") // get a forward SubBytes
			}
		}
		for index, tbyte := range t { // every byte in the word gets XORed with the byte a $keylen before it
			expandedkey = append(expandedkey, tbyte^expandedkey[pos-keylen+index])
		}
		keybytes += 4
	}
	roundkeys := splitblocktochunks(expandedkey, blockwidth, "rotated") // separate the key material into round keys
	return roundkeys
}

func keyschedcore(inword []byte, iter int) []byte {
	// core key schedule operations:
	// bytewise left-rotation of the 4-byte input word
	// forward SubBytes applied to all four bytes
	// first byte XORed with rcon(iteration count)
	if len(inword) != 4 {
		fmt.Println("[!] keyschedcore() provided with a word with length != 4")
		os.Exit(1)
	}
	outword := SubBytes(rotl(inword), "forward")
	outword[0] ^= rcon(byte(iter))
	return outword
}

func rcon(i byte) byte {
	// Rijndael's 'rcon' function: 2^i within GF(2^8)
	// i don't really understand exponentiation in Galois fields,
	// so this is a port of Sam Trenholme's C implementation
	c := byte(1)
	if i == 0 {
		return 0x8d
	}
	for i != 1 {
		var b byte
		b = c & 0x80 // what the fuck
		c <<= 1
		if b == 0x80 {
			c ^= 0x1b
		}
		i -= 1
	}
	return c
}

// ----- ROUND OPERATIONS -----

func AddRoundKey(state []byte, roundkey []byte) []byte {
	// XOR a state input with a round key
	var output []byte
	for index, _ := range state {
		outbyte := state[index] ^ roundkey[index]
		output = append(output, outbyte)
	}
	return output
}

func SubBytes(inbytes []byte, direction string) []byte {
	// replace every byte in a bytearray with its corresponding byte in the specified S-box lookup table
	var output []byte
	if direction == "forward" {
		for _, char := range inbytes {
			output = append(output, sbox_fwd[char])
		}
	} else if direction == "inverse" {
		for _, char := range inbytes {
			output = append(output, sbox_inv[char])
		}
	}
	return output
}

func ShiftRows(inbytes []byte, direction string) []byte {
	// bytewise rotate row n by n bytes, left-rotation forward and right-rotation inverse
	// e.g. (forward)
	// ABCD
	// ABCD
	// ABCD
	// ABCD
	// ->
	// ABCD
	// BCDA
	// CDAB
	// DABC
	rows := splitblocktochunks(inbytes, 4, "straight")
	if direction == "forward" {
		rows[1] = rotl(rows[1])
		rows[2] = rotl(rotl(rows[2]))
		rows[3] = rotl(rotl(rotl(rows[3]))) // i know n-1 Ls make an R. but readability
	} else if direction == "inverse" {
		rows[1] = rotr(rows[1])
		rows[2] = rotr(rotr(rows[2]))
		rows[3] = rotr(rotr(rotr(rows[3])))
	}
	outbytes := flattenslice(rows)
	return outbytes
}

func MixColumns(inbytes []byte, direction string) []byte {
	// matrix multiplication in GF(2^8)
	// rather than perform repeated Galois field multiplication, we'll just use lookup tables
	// the matrix:
	// 2 3 1 1
	// 1 2 3 1
	// 1 1 2 3
	// 3 1 1 2
	// the inverse matrix:
	// 14 11 13 9
	// 9 14 11 13
	// 13 9 14 11
	// 11 13 9 14
	var finishedcolumns [][]byte
	finishedcolumns = make([][]byte, 4)
	columns := splitblocktocolumns(inbytes)
	for index, col := range columns {
		var r0, r1, r2, r3 byte
		if direction == "forward" {
			r0 = gmult(col[0], 2) ^ gmult(col[1], 3) ^ col[2] ^ col[3] // bitwise XOR is addition
			r1 = col[0] ^ gmult(col[1], 2) ^ gmult(col[2], 3) ^ col[3] // in a Galois field
			r2 = col[0] ^ col[1] ^ gmult(col[2], 2) ^ gmult(col[3], 3) // and gmult() handles
			r3 = gmult(col[0], 3) ^ col[1] ^ col[2] ^ gmult(col[3], 2) // Galois multiplication
		} else if direction == "inverse" {
			r0 = gmult(col[0], 14) ^ gmult(col[1], 11) ^ gmult(col[2], 13) ^ gmult(col[3], 9)
			r1 = gmult(col[0], 9) ^ gmult(col[1], 14) ^ gmult(col[2], 11) ^ gmult(col[3], 13)
			r2 = gmult(col[0], 13) ^ gmult(col[1], 9) ^ gmult(col[2], 14) ^ gmult(col[3], 11)
			r3 = gmult(col[0], 11) ^ gmult(col[1], 13) ^ gmult(col[2], 9) ^ gmult(col[3], 14)
		}
		finishedcolumns[index] = append(finishedcolumns[index], r0, r1, r2, r3)
	}
	columnordered := flattenslice(finishedcolumns)
	rowordered := splitblocktocolumns(columnordered) // block -> column reordering is invertible
	return flattenslice(rowordered)
}

func gmult(inbyte byte, factor int) byte {
	// perform multiplication in Rijndael's Finite Field (GF(2^8))
	// as per earlier we're using lookup tables for speed and simplicity
	var outbyte byte
	if factor == 2 {
		outbyte = gmult2[inbyte]
	} else if factor == 3 {
		outbyte = gmult3[inbyte]
	} else if factor == 9 {
		outbyte = gmult9[inbyte]
	} else if factor == 11 {
		outbyte = gmult11[inbyte]
	} else if factor == 13 {
		outbyte = gmult13[inbyte]
	} else if factor == 14 {
		outbyte = gmult14[inbyte]
	} else {
		fmt.Println("[!] gmult() given inappropriate factor")
		os.Exit(1)
	}
	return outbyte
}

// ----- ROUNDS -----

func initialround(inblock []byte, roundkey []byte) []byte {
	// only AddRoundKey
	state := AddRoundKey(inblock, roundkey)
	return state
}

func round(inblock []byte, roundkey []byte, direction string) []byte {
	// SubBytes, ShiftRows, MixColumns, AddRoundKey
	state := inblock
	if direction == "forward" {
		state = SubBytes(state, direction)
		state = ShiftRows(state, direction)
		state = MixColumns(state, direction)
		state = AddRoundKey(state, roundkey)
	} else if direction == "inverse" {
		state = AddRoundKey(state, roundkey)
		state = MixColumns(state, direction)
		state = ShiftRows(state, direction)
		state = SubBytes(state, direction)

	}
	return state
}

func finalround(inblock []byte, roundkey []byte, direction string) []byte {
	// SubBytes, ShiftRows, AddRoundKey
	state := inblock
	if direction == "forward" {
		state = SubBytes(state, direction)
		state = ShiftRows(state, direction)
		state = AddRoundKey(state, roundkey)
	} else if direction == "inverse" {
		state = AddRoundKey(state, roundkey)
		state = ShiftRows(state, direction)
		state = SubBytes(state, direction)
	}
	return state
}

func encrypt(plaintext []byte, key []byte) []byte {
	// a single block of AES
	direction := "forward"
	roundkeys := keyexpansion(key)
	rounds := len(roundkeys) - 1
	state := makeaesmatrix(plaintext)
	state = initialround(state, roundkeys[0])
	for r := 1; r < rounds; r++ {
		state = round(state, roundkeys[r], direction)
	}
	state = finalround(state, roundkeys[rounds], direction)
	return makeaesmatrix(state) // going back to row-major order
}

func decrypt(ciphertext []byte, key []byte) []byte {
	// exactly the same as encrypt() but inverted
	direction := "inverse"
	roundkeys := keyexpansion(key)
	rounds := len(roundkeys) - 1
	state := makeaesmatrix(ciphertext)
	state = finalround(state, roundkeys[rounds], direction)
	for r := rounds - 1; r > 0; r-- {
		state = round(state, roundkeys[r], direction)
	}
	state = initialround(state, roundkeys[0])

	return makeaesmatrix(state)
}

// ----- UTILITY -----

func rotl(inword []byte) []byte {
	// left-rotate a bytearray by one byte (e.g. ABCD -> BCDA)
	var outword []byte
	a := inword[0]
	for c := 1; c < len(inword); c++ {
		outword = append(outword, inword[c])
	}
	outword = append(outword, a)
	return outword
}

func rotr(inword []byte) []byte {
	// right-rotate a bytearray by one byte (e.g. ABCD -> DABC)
	var outword []byte
	outword = append(outword, inword[len(inword)-1])
	for c := 0; c < len(inword)-1; c++ {
		outword = append(outword, inword[c])
	}
	return outword
}

func splitblocktochunks(block []byte, chunksize int, row2column string) [][]byte {
	// creates a 2-dimensional slice of slices (of bytes)
	// e.g. splitblocktochunks(ABCDEFGH, 2) -> [[AB] [CD] [EF] [GH]]
	if len(block)%chunksize != 0 {
		fmt.Println("[!] splitblocktochunks() was given a block/chunk ratio with a remainder")
		os.Exit(1)
	}
	var chunks [][]byte
	for i := 0; i < len(block); i += chunksize {
		if row2column == "straight" {
			chunks = append(chunks, block[i:i+chunksize])
		} else if row2column == "rotated" { // so we can rotate the round keys to column-major order
			chunks = append(chunks, makeaesmatrix(block[i:i+chunksize]))
		}
	}
	return chunks
}

func splitblocktocolumns(block []byte) [][]byte {
	// splits a block into columns of length 4
	// e.g.
	// ABCD
	// ABCD
	// ABCD
	// ABCD
	// ->
	// [AAAA, BBBB, CCCC, DDDD]
	var columns [][]byte
	columns = make([][]byte, 4)
	for i := 0; i < len(block); i++ {
		column := (i % 4)
		columns[column] = append(columns[column], block[i])
	}
	return columns
}

func flattenslice(inslice [][]byte) []byte {
	// flattens a 2-dimensional slice of slices (of bytes)
	// e.g. flattenslice([[AB] [CD]] [EF] [GF]) -> ABCDEFGH
	var outslice []byte
	for _, slice := range inslice {
		for _, inbyte := range slice {
			outslice = append(outslice, inbyte)
		}
	}
	return outslice
}

func makeaesmatrix(inblock []byte) []byte {
	// "rotates" a block from row-major order to column-major order (or back)
	return flattenslice(splitblocktocolumns(inblock))
}

func b64encode(bytesin []byte) string {
	return base64.StdEncoding.EncodeToString(bytesin)
}

func b64decode(textin string) []byte {
	bytesout, _ := base64.StdEncoding.DecodeString(textin)
	return bytesout
}

func makebytes(textin string) []byte {
	// string to bytearray
	return []byte(textin)
}

func makestring(inbytes []byte) string {
	// bytearray to string
	return string(inbytes[:])
}

// ----- S-BOXES -----

var sbox_fwd, sbox_inv []byte
var gmult2, gmult3, gmult9, gmult11, gmult13, gmult14 []byte

func sboxinit() {
	// here we define lookup tables for the Rijndael subtitution boxes.
	// these are generated by performing a static affine transformation
	// on the input's modular multiplicative inverse in GF(2^8)
	// we're not generating these from scratch as i don't really get Galois fields
	// plus it's faster to just use lookup tables :S
	sbox_fwd = []byte{
		0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
		0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
		0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
		0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
		0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
		0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
		0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
		0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
		0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
		0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
		0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
		0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
		0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
		0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
		0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
		0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16,
	}
	sbox_inv = []byte{
		0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
		0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
		0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
		0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
		0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
		0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
		0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
		0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
		0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
		0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
		0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
		0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
		0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
		0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
		0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
		0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d,
	}
}

func mixboxinit() {
	// MixColumns lookup tables. galois field multiplication every time would be a lot of overhead
	gmult2 = []byte{
		0x00, 0x02, 0x04, 0x06, 0x08, 0x0a, 0x0c, 0x0e, 0x10, 0x12, 0x14, 0x16, 0x18, 0x1a, 0x1c, 0x1e,
		0x20, 0x22, 0x24, 0x26, 0x28, 0x2a, 0x2c, 0x2e, 0x30, 0x32, 0x34, 0x36, 0x38, 0x3a, 0x3c, 0x3e,
		0x40, 0x42, 0x44, 0x46, 0x48, 0x4a, 0x4c, 0x4e, 0x50, 0x52, 0x54, 0x56, 0x58, 0x5a, 0x5c, 0x5e,
		0x60, 0x62, 0x64, 0x66, 0x68, 0x6a, 0x6c, 0x6e, 0x70, 0x72, 0x74, 0x76, 0x78, 0x7a, 0x7c, 0x7e,
		0x80, 0x82, 0x84, 0x86, 0x88, 0x8a, 0x8c, 0x8e, 0x90, 0x92, 0x94, 0x96, 0x98, 0x9a, 0x9c, 0x9e,
		0xa0, 0xa2, 0xa4, 0xa6, 0xa8, 0xaa, 0xac, 0xae, 0xb0, 0xb2, 0xb4, 0xb6, 0xb8, 0xba, 0xbc, 0xbe,
		0xc0, 0xc2, 0xc4, 0xc6, 0xc8, 0xca, 0xcc, 0xce, 0xd0, 0xd2, 0xd4, 0xd6, 0xd8, 0xda, 0xdc, 0xde,
		0xe0, 0xe2, 0xe4, 0xe6, 0xe8, 0xea, 0xec, 0xee, 0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe,
		0x1b, 0x19, 0x1f, 0x1d, 0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,
		0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d, 0x23, 0x21, 0x27, 0x25,
		0x5b, 0x59, 0x5f, 0x5d, 0x53, 0x51, 0x57, 0x55, 0x4b, 0x49, 0x4f, 0x4d, 0x43, 0x41, 0x47, 0x45,
		0x7b, 0x79, 0x7f, 0x7d, 0x73, 0x71, 0x77, 0x75, 0x6b, 0x69, 0x6f, 0x6d, 0x63, 0x61, 0x67, 0x65,
		0x9b, 0x99, 0x9f, 0x9d, 0x93, 0x91, 0x97, 0x95, 0x8b, 0x89, 0x8f, 0x8d, 0x83, 0x81, 0x87, 0x85,
		0xbb, 0xb9, 0xbf, 0xbd, 0xb3, 0xb1, 0xb7, 0xb5, 0xab, 0xa9, 0xaf, 0xad, 0xa3, 0xa1, 0xa7, 0xa5,
		0xdb, 0xd9, 0xdf, 0xdd, 0xd3, 0xd1, 0xd7, 0xd5, 0xcb, 0xc9, 0xcf, 0xcd, 0xc3, 0xc1, 0xc7, 0xc5,
		0xfb, 0xf9, 0xff, 0xfd, 0xf3, 0xf1, 0xf7, 0xf5, 0xeb, 0xe9, 0xef, 0xed, 0xe3, 0xe1, 0xe7, 0xe5,
	}
	gmult3 = []byte{
		0x00, 0x03, 0x06, 0x05, 0x0c, 0x0f, 0x0a, 0x09, 0x18, 0x1b, 0x1e, 0x1d, 0x14, 0x17, 0x12, 0x11,
		0x30, 0x33, 0x36, 0x35, 0x3c, 0x3f, 0x3a, 0x39, 0x28, 0x2b, 0x2e, 0x2d, 0x24, 0x27, 0x22, 0x21,
		0x60, 0x63, 0x66, 0x65, 0x6c, 0x6f, 0x6a, 0x69, 0x78, 0x7b, 0x7e, 0x7d, 0x74, 0x77, 0x72, 0x71,
		0x50, 0x53, 0x56, 0x55, 0x5c, 0x5f, 0x5a, 0x59, 0x48, 0x4b, 0x4e, 0x4d, 0x44, 0x47, 0x42, 0x41,
		0xc0, 0xc3, 0xc6, 0xc5, 0xcc, 0xcf, 0xca, 0xc9, 0xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1,
		0xf0, 0xf3, 0xf6, 0xf5, 0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,
		0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd, 0xb4, 0xb7, 0xb2, 0xb1,
		0x90, 0x93, 0x96, 0x95, 0x9c, 0x9f, 0x9a, 0x99, 0x88, 0x8b, 0x8e, 0x8d, 0x84, 0x87, 0x82, 0x81,
		0x9b, 0x98, 0x9d, 0x9e, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86, 0x8f, 0x8c, 0x89, 0x8a,
		0xab, 0xa8, 0xad, 0xae, 0xa7, 0xa4, 0xa1, 0xa2, 0xb3, 0xb0, 0xb5, 0xb6, 0xbf, 0xbc, 0xb9, 0xba,
		0xfb, 0xf8, 0xfd, 0xfe, 0xf7, 0xf4, 0xf1, 0xf2, 0xe3, 0xe0, 0xe5, 0xe6, 0xef, 0xec, 0xe9, 0xea,
		0xcb, 0xc8, 0xcd, 0xce, 0xc7, 0xc4, 0xc1, 0xc2, 0xd3, 0xd0, 0xd5, 0xd6, 0xdf, 0xdc, 0xd9, 0xda,
		0x5b, 0x58, 0x5d, 0x5e, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46, 0x4f, 0x4c, 0x49, 0x4a,
		0x6b, 0x68, 0x6d, 0x6e, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76, 0x7f, 0x7c, 0x79, 0x7a,
		0x3b, 0x38, 0x3d, 0x3e, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26, 0x2f, 0x2c, 0x29, 0x2a,
		0x0b, 0x08, 0x0d, 0x0e, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16, 0x1f, 0x1c, 0x19, 0x1a,
	}
	gmult9 = []byte{
		0x00, 0x09, 0x12, 0x1b, 0x24, 0x2d, 0x36, 0x3f, 0x48, 0x41, 0x5a, 0x53, 0x6c, 0x65, 0x7e, 0x77,
		0x90, 0x99, 0x82, 0x8b, 0xb4, 0xbd, 0xa6, 0xaf, 0xd8, 0xd1, 0xca, 0xc3, 0xfc, 0xf5, 0xee, 0xe7,
		0x3b, 0x32, 0x29, 0x20, 0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c,
		0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8, 0xc7, 0xce, 0xd5, 0xdc,
		0x76, 0x7f, 0x64, 0x6d, 0x52, 0x5b, 0x40, 0x49, 0x3e, 0x37, 0x2c, 0x25, 0x1a, 0x13, 0x08, 0x01,
		0xe6, 0xef, 0xf4, 0xfd, 0xc2, 0xcb, 0xd0, 0xd9, 0xae, 0xa7, 0xbc, 0xb5, 0x8a, 0x83, 0x98, 0x91,
		0x4d, 0x44, 0x5f, 0x56, 0x69, 0x60, 0x7b, 0x72, 0x05, 0x0c, 0x17, 0x1e, 0x21, 0x28, 0x33, 0x3a,
		0xdd, 0xd4, 0xcf, 0xc6, 0xf9, 0xf0, 0xeb, 0xe2, 0x95, 0x9c, 0x87, 0x8e, 0xb1, 0xb8, 0xa3, 0xaa,
		0xec, 0xe5, 0xfe, 0xf7, 0xc8, 0xc1, 0xda, 0xd3, 0xa4, 0xad, 0xb6, 0xbf, 0x80, 0x89, 0x92, 0x9b,
		0x7c, 0x75, 0x6e, 0x67, 0x58, 0x51, 0x4a, 0x43, 0x34, 0x3d, 0x26, 0x2f, 0x10, 0x19, 0x02, 0x0b,
		0xd7, 0xde, 0xc5, 0xcc, 0xf3, 0xfa, 0xe1, 0xe8, 0x9f, 0x96, 0x8d, 0x84, 0xbb, 0xb2, 0xa9, 0xa0,
		0x47, 0x4e, 0x55, 0x5c, 0x63, 0x6a, 0x71, 0x78, 0x0f, 0x06, 0x1d, 0x14, 0x2b, 0x22, 0x39, 0x30,
		0x9a, 0x93, 0x88, 0x81, 0xbe, 0xb7, 0xac, 0xa5, 0xd2, 0xdb, 0xc0, 0xc9, 0xf6, 0xff, 0xe4, 0xed,
		0x0a, 0x03, 0x18, 0x11, 0x2e, 0x27, 0x3c, 0x35, 0x42, 0x4b, 0x50, 0x59, 0x66, 0x6f, 0x74, 0x7d,
		0xa1, 0xa8, 0xb3, 0xba, 0x85, 0x8c, 0x97, 0x9e, 0xe9, 0xe0, 0xfb, 0xf2, 0xcd, 0xc4, 0xdf, 0xd6,
		0x31, 0x38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62, 0x5d, 0x54, 0x4f, 0x46,
	}
	gmult11 = []byte{
		0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45, 0x74, 0x7f, 0x62, 0x69,
		0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x97, 0x8a, 0x81, 0xe8, 0xe3, 0xfe, 0xf5, 0xc4, 0xcf, 0xd2, 0xd9,
		0x7b, 0x70, 0x6d, 0x66, 0x57, 0x5c, 0x41, 0x4a, 0x23, 0x28, 0x35, 0x3e, 0x0f, 0x04, 0x19, 0x12,
		0xcb, 0xc0, 0xdd, 0xd6, 0xe7, 0xec, 0xf1, 0xfa, 0x93, 0x98, 0x85, 0x8e, 0xbf, 0xb4, 0xa9, 0xa2,
		0xf6, 0xfd, 0xe0, 0xeb, 0xda, 0xd1, 0xcc, 0xc7, 0xae, 0xa5, 0xb8, 0xb3, 0x82, 0x89, 0x94, 0x9f,
		0x46, 0x4d, 0x50, 0x5b, 0x6a, 0x61, 0x7c, 0x77, 0x1e, 0x15, 0x08, 0x03, 0x32, 0x39, 0x24, 0x2f,
		0x8d, 0x86, 0x9b, 0x90, 0xa1, 0xaa, 0xb7, 0xbc, 0xd5, 0xde, 0xc3, 0xc8, 0xf9, 0xf2, 0xef, 0xe4,
		0x3d, 0x36, 0x2b, 0x20, 0x11, 0x1a, 0x07, 0x0c, 0x65, 0x6e, 0x73, 0x78, 0x49, 0x42, 0x5f, 0x54,
		0xf7, 0xfc, 0xe1, 0xea, 0xdb, 0xd0, 0xcd, 0xc6, 0xaf, 0xa4, 0xb9, 0xb2, 0x83, 0x88, 0x95, 0x9e,
		0x47, 0x4c, 0x51, 0x5a, 0x6b, 0x60, 0x7d, 0x76, 0x1f, 0x14, 0x09, 0x02, 0x33, 0x38, 0x25, 0x2e,
		0x8c, 0x87, 0x9a, 0x91, 0xa0, 0xab, 0xb6, 0xbd, 0xd4, 0xdf, 0xc2, 0xc9, 0xf8, 0xf3, 0xee, 0xe5,
		0x3c, 0x37, 0x2a, 0x21, 0x10, 0x1b, 0x06, 0x0d, 0x64, 0x6f, 0x72, 0x79, 0x48, 0x43, 0x5e, 0x55,
		0x01, 0x0a, 0x17, 0x1c, 0x2d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44, 0x75, 0x7e, 0x63, 0x68,
		0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80, 0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8,
		0x7a, 0x71, 0x6c, 0x67, 0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3f, 0x0e, 0x05, 0x18, 0x13,
		0xca, 0xc1, 0xdc, 0xd7, 0xe6, 0xed, 0xf0, 0xfb, 0x92, 0x99, 0x84, 0x8f, 0xbe, 0xb5, 0xa8, 0xa3,
	}
	gmult13 = []byte{
		0x00, 0x0d, 0x1a, 0x17, 0x34, 0x39, 0x2e, 0x23, 0x68, 0x65, 0x72, 0x7f, 0x5c, 0x51, 0x46, 0x4b,
		0xd0, 0xdd, 0xca, 0xc7, 0xe4, 0xe9, 0xfe, 0xf3, 0xb8, 0xb5, 0xa2, 0xaf, 0x8c, 0x81, 0x96, 0x9b,
		0xbb, 0xb6, 0xa1, 0xac, 0x8f, 0x82, 0x95, 0x98, 0xd3, 0xde, 0xc9, 0xc4, 0xe7, 0xea, 0xfd, 0xf0,
		0x6b, 0x66, 0x71, 0x7c, 0x5f, 0x52, 0x45, 0x48, 0x03, 0x0e, 0x19, 0x14, 0x37, 0x3a, 0x2d, 0x20,
		0x6d, 0x60, 0x77, 0x7a, 0x59, 0x54, 0x43, 0x4e, 0x05, 0x08, 0x1f, 0x12, 0x31, 0x3c, 0x2b, 0x26,
		0xbd, 0xb0, 0xa7, 0xaa, 0x89, 0x84, 0x93, 0x9e, 0xd5, 0xd8, 0xcf, 0xc2, 0xe1, 0xec, 0xfb, 0xf6,
		0xd6, 0xdb, 0xcc, 0xc1, 0xe2, 0xef, 0xf8, 0xf5, 0xbe, 0xb3, 0xa4, 0xa9, 0x8a, 0x87, 0x90, 0x9d,
		0x06, 0x0b, 0x1c, 0x11, 0x32, 0x3f, 0x28, 0x25, 0x6e, 0x63, 0x74, 0x79, 0x5a, 0x57, 0x40, 0x4d,
		0xda, 0xd7, 0xc0, 0xcd, 0xee, 0xe3, 0xf4, 0xf9, 0xb2, 0xbf, 0xa8, 0xa5, 0x86, 0x8b, 0x9c, 0x91,
		0x0a, 0x07, 0x10, 0x1d, 0x3e, 0x33, 0x24, 0x29, 0x62, 0x6f, 0x78, 0x75, 0x56, 0x5b, 0x4c, 0x41,
		0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42, 0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a,
		0xb1, 0xbc, 0xab, 0xa6, 0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7, 0xfa,
		0xb7, 0xba, 0xad, 0xa0, 0x83, 0x8e, 0x99, 0x94, 0xdf, 0xd2, 0xc5, 0xc8, 0xeb, 0xe6, 0xf1, 0xfc,
		0x67, 0x6a, 0x7d, 0x70, 0x53, 0x5e, 0x49, 0x44, 0x0f, 0x02, 0x15, 0x18, 0x3b, 0x36, 0x21, 0x2c,
		0x0c, 0x01, 0x16, 0x1b, 0x38, 0x35, 0x22, 0x2f, 0x64, 0x69, 0x7e, 0x73, 0x50, 0x5d, 0x4a, 0x47,
		0xdc, 0xd1, 0xc6, 0xcb, 0xe8, 0xe5, 0xf2, 0xff, 0xb4, 0xb9, 0xae, 0xa3, 0x80, 0x8d, 0x9a, 0x97,
	}
	gmult14 = []byte{
		0x00, 0x0e, 0x1c, 0x12, 0x38, 0x36, 0x24, 0x2a, 0x70, 0x7e, 0x6c, 0x62, 0x48, 0x46, 0x54, 0x5a,
		0xe0, 0xee, 0xfc, 0xf2, 0xd8, 0xd6, 0xc4, 0xca, 0x90, 0x9e, 0x8c, 0x82, 0xa8, 0xa6, 0xb4, 0xba,
		0xdb, 0xd5, 0xc7, 0xc9, 0xe3, 0xed, 0xff, 0xf1, 0xab, 0xa5, 0xb7, 0xb9, 0x93, 0x9d, 0x8f, 0x81,
		0x3b, 0x35, 0x27, 0x29, 0x03, 0x0d, 0x1f, 0x11, 0x4b, 0x45, 0x57, 0x59, 0x73, 0x7d, 0x6f, 0x61,
		0xad, 0xa3, 0xb1, 0xbf, 0x95, 0x9b, 0x89, 0x87, 0xdd, 0xd3, 0xc1, 0xcf, 0xe5, 0xeb, 0xf9, 0xf7,
		0x4d, 0x43, 0x51, 0x5f, 0x75, 0x7b, 0x69, 0x67, 0x3d, 0x33, 0x21, 0x2f, 0x05, 0x0b, 0x19, 0x17,
		0x76, 0x78, 0x6a, 0x64, 0x4e, 0x40, 0x52, 0x5c, 0x06, 0x08, 0x1a, 0x14, 0x3e, 0x30, 0x22, 0x2c,
		0x96, 0x98, 0x8a, 0x84, 0xae, 0xa0, 0xb2, 0xbc, 0xe6, 0xe8, 0xfa, 0xf4, 0xde, 0xd0, 0xc2, 0xcc,
		0x41, 0x4f, 0x5d, 0x53, 0x79, 0x77, 0x65, 0x6b, 0x31, 0x3f, 0x2d, 0x23, 0x09, 0x07, 0x15, 0x1b,
		0xa1, 0xaf, 0xbd, 0xb3, 0x99, 0x97, 0x85, 0x8b, 0xd1, 0xdf, 0xcd, 0xc3, 0xe9, 0xe7, 0xf5, 0xfb,
		0x9a, 0x94, 0x86, 0x88, 0xa2, 0xac, 0xbe, 0xb0, 0xea, 0xe4, 0xf6, 0xf8, 0xd2, 0xdc, 0xce, 0xc0,
		0x7a, 0x74, 0x66, 0x68, 0x42, 0x4c, 0x5e, 0x50, 0x0a, 0x04, 0x16, 0x18, 0x32, 0x3c, 0x2e, 0x20,
		0xec, 0xe2, 0xf0, 0xfe, 0xd4, 0xda, 0xc8, 0xc6, 0x9c, 0x92, 0x80, 0x8e, 0xa4, 0xaa, 0xb8, 0xb6,
		0x0c, 0x02, 0x10, 0x1e, 0x34, 0x3a, 0x28, 0x26, 0x7c, 0x72, 0x60, 0x6e, 0x44, 0x4a, 0x58, 0x56,
		0x37, 0x39, 0x2b, 0x25, 0x0f, 0x01, 0x13, 0x1d, 0x47, 0x49, 0x5b, 0x55, 0x7f, 0x71, 0x63, 0x6d,
		0xd7, 0xd9, 0xcb, 0xc5, 0xef, 0xe1, 0xf3, 0xfd, 0xa7, 0xa9, 0xbb, 0xb5, 0x9f, 0x91, 0x83, 0x8d,
	}
}

// ----- MAIN -----

func main() {
	sboxinit()
	mixboxinit()
	plaintext := makebytes("Block of sixteen")
	key := makebytes("YELLOW SUBMARINE")
	ciphertext := encrypt(plaintext, key)
	fmt.Println("plaintext:\t", makestring(plaintext))
	fmt.Println("plaintext b64:\t", b64encode(plaintext))
	fmt.Println("\t\t-----")
	fmt.Println("ciphertext:\t", makestring(ciphertext))
	fmt.Println("ciphertext b64:\t", b64encode(ciphertext))
	fmt.Println("\t\t-----")
	checkpt := decrypt(ciphertext, key)
	fmt.Println("decrypted b64:\t", b64encode(checkpt))
	fmt.Println("decrypted:\t", makestring(checkpt))
}