/*
 * Copyright 2004-2008 H2 Group. Licensed under the H2 License, Version 1.0
 * (http://h2database.com/html/license.html).
 * Initial Developer: H2 Group
 */
package org.h2.security;

import org.h2.constant.SysProperties;
import org.h2.message.Message;

/**
 * An implementation of the AES block cipher algorithm,
 * also known as Rijndael. Only AES-128 is supported by this class.
 */
public class AES implements BlockCipher {

    private static final int[] RCON = new int[10];
    private static final int[] FS = new int[256];
    private static final int[] FT0 = new int[256];
    private static final int[] FT1 = new int[256];
    private static final int[] FT2 = new int[256];
    private static final int[] FT3 = new int[256];
    private static final int[] RS = new int[256];
    private static final int[] RT0 = new int[256];
    private static final int[] RT1 = new int[256];
    private static final int[] RT2 = new int[256];
    private static final int[] RT3 = new int[256];
    private int[] encKey = new int[44];
    private int[] decKey = new int[44];

    private static int rot8(int x) {
        return (x >>> 8) | (x << 24);
    }

    private static int xtime(int x) {
        return ((x << 1) ^ (((x & 0x80) != 0) ? 0x1b : 0)) & 255;
    }

    private static int mul(int[] pow, int[] log, int x, int y) {
        return ((x != 0 && y != 0) ? pow[(log[x] + log[y]) % 255] : 0);
    }

    static {
        int[] pow = new int[256];
        int[] log = new int[256];
        for (int i = 0, x = 1; i < 256; i++, x ^= xtime(x)) {
            pow[i] = x;
            log[x] = i;
        }
        for (int i = 0, x = 1; i < 10; i++, x = xtime(x)) {
            RCON[i] = x << 24;
        }
        FS[0x00] = 0x63;
        RS[0x63] = 0x00;
        for (int i = 1; i < 256; i++) {
            int x = pow[255 - log[i]], y = x;
            y = ((y << 1) | (y >> 7)) & 255;
            x ^= y;
            y = ((y << 1) | (y >> 7)) & 255;
            x ^= y;
            y = ((y << 1) | (y >> 7)) & 255;
            x ^= y;
            y = ((y << 1) | (y >> 7)) & 255;
            x ^= y ^ 0x63;
            FS[i] = x & 255;
            RS[x] = i & 255;
        }
        for (int i = 0; i < 256; i++) {
            int x = FS[i], y = xtime(x);
            FT0[i] = (x ^ y) ^ (x << 8) ^ (x << 16) ^ (y << 24);
            FT1[i] = rot8(FT0[i]);
            FT2[i] = rot8(FT1[i]);
            FT3[i] = rot8(FT2[i]);
            y = RS[i];
            RT0[i] = mul(pow, log, 0x0b, y) ^ (mul(pow, log, 0x0d, y) << 8)
                ^ (mul(pow, log, 0x09, y) << 16) ^ (mul(pow, log, 0x0e, y) << 24);
            RT1[i] = rot8(RT0[i]);
            RT2[i] = rot8(RT1[i]);
            RT3[i] = rot8(RT2[i]);
        }
    }

    private int getDec(int t) {
        return RT0[FS[(t >> 24) & 255]] ^ RT1[FS[(t >> 16) & 255]] ^ RT2[FS[(t >> 8) & 255]] ^ RT3[FS[t & 255]];
    }

    public void setKey(byte[] key) {
        for (int i = 0, j = 0; i < 4; i++) {
            encKey[i] = decKey[i] = ((key[j++] & 255) << 24) | ((key[j++] & 255) << 16) | ((key[j++] & 255) << 8)
                    | (key[j++] & 255);
        }
        int e = 0;
        for (int i = 0; i < 10; i++, e += 4) {
            encKey[e + 4] = encKey[e] ^ RCON[i] ^ (FS[(encKey[e + 3] >> 16) & 255] << 24)
                ^ (FS[(encKey[e + 3] >> 8) & 255] << 16) ^ (FS[(encKey[e + 3]) & 255] << 8) ^ FS[(encKey[e + 3] >> 24) & 255];
            encKey[e + 5] = encKey[e + 1] ^ encKey[e + 4];
            encKey[e + 6] = encKey[e + 2] ^ encKey[e + 5];
            encKey[e + 7] = encKey[e + 3] ^ encKey[e + 6];
        }
        int d = 0;
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
        for (int i = 1; i < 10; i++) {
            e -= 8;
            decKey[d++] = getDec(encKey[e++]);
            decKey[d++] = getDec(encKey[e++]);
            decKey[d++] = getDec(encKey[e++]);
            decKey[d++] = getDec(encKey[e++]);
        }
        e -= 8;
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
        decKey[d++] = encKey[e++];
    }

    public void encrypt(byte[] buff, int off, int len) {
        if (SysProperties.CHECK && (len % ALIGN != 0)) {
            throw Message.getInternalError("unaligned len " + len);
        }
        for (int i = off; i < off + len; i += 16) {