AES.pm 19 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501
  1. #------------------------------------------------------------------------------
  2. # File: AES.pm
  3. #
  4. # Description: AES encryption with cipher-block chaining
  5. #
  6. # Revisions: 2010/10/14 - P. Harvey Created
  7. #
  8. # References: 1) http://www.hoozi.com/Articles/AESEncryption.htm
  9. # 2) http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf
  10. # 3) http://www.faqs.org/rfcs/rfc3602.html
  11. #------------------------------------------------------------------------------
  12. package Image::ExifTool::AES;
  13. use strict;
  14. use vars qw($VERSION @ISA @EXPORT_OK);
  15. require Exporter;
  16. $VERSION = '1.01';
  17. @ISA = qw(Exporter);
  18. @EXPORT_OK = qw(Crypt);
  19. my $seeded; # flag set if we already seeded random number generator
  20. my $nr; # number of rounds in AES cipher
  21. my @cbc; # cipher-block chaining bytes
  22. # arrays (all unsigned character) to hold intermediate results during encryption
  23. my @state = ([],[],[],[]); # the 2-dimensional state array
  24. my @RoundKey; # round keys
  25. my @sbox = (
  26. 0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
  27. 0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
  28. 0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
  29. 0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
  30. 0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
  31. 0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
  32. 0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
  33. 0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
  34. 0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
  35. 0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
  36. 0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
  37. 0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
  38. 0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
  39. 0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
  40. 0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
  41. 0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16,
  42. );
  43. # reverse sbox
  44. my @rsbox = (
  45. 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
  46. 0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
  47. 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
  48. 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
  49. 0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
  50. 0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
  51. 0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
  52. 0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
  53. 0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
  54. 0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
  55. 0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
  56. 0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
  57. 0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
  58. 0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
  59. 0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
  60. 0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d,
  61. );
  62. # the round constant word array, $rcon[i], contains the values given by
  63. # x to the power (i-1) being powers of x (x is denoted as {02}) in the field GF(2^8)
  64. # Note that i starts at 1, not 0).
  65. my @rcon = (
  66. 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,
  67. 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,
  68. 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,
  69. 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,
  70. 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,
  71. 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,
  72. 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,
  73. 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,
  74. 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,
  75. 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,
  76. 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,
  77. 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,
  78. 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,
  79. 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,
  80. 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,
  81. 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb,
  82. );
  83. #------------------------------------------------------------------------------
  84. # This function produces 4*($nr+1) round keys.
  85. # The round keys are used in each round to encrypt the states.
  86. # Inputs: 0) key string (must be 16, 24 or 32 bytes long)
  87. sub KeyExpansion($)
  88. {
  89. my $key = shift;
  90. my @key = unpack 'C*', $key; # convert the key into a byte array
  91. my $nk = int(length($key) / 4); # number of 32-bit words in the key
  92. $nr = $nk + 6; # number of rounds
  93. # temporary variables (all unsigned characters)
  94. my ($i,@temp);
  95. # The first round key is the key itself.
  96. for ($i=0; $i<$nk; ++$i) {
  97. @RoundKey[$i*4..$i*4+3] = @key[$i*4..$i*4+3];
  98. }
  99. # All other round keys are found from the previous round keys.
  100. while ($i < (4 * ($nr+1))) {
  101. @temp[0..3] = @RoundKey[($i-1)*4..($i-1)*4+3];
  102. if ($i % $nk == 0) {
  103. # rotate the 4 bytes in a word to the left once
  104. # [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
  105. @temp[0..3] = @temp[1,2,3,0];
  106. # take a four-byte input word and apply the S-box
  107. # to each of the four bytes to produce an output word.
  108. @temp[0..3] = @sbox[@temp[0..3]];
  109. $temp[0] = $temp[0] ^ $rcon[$i/$nk];
  110. } elsif ($nk > 6 && $i % $nk == 4) {
  111. @temp[0..3] = @sbox[@temp[0..3]];
  112. }
  113. $RoundKey[$i*4+0] = $RoundKey[($i-$nk)*4+0] ^ $temp[0];
  114. $RoundKey[$i*4+1] = $RoundKey[($i-$nk)*4+1] ^ $temp[1];
  115. $RoundKey[$i*4+2] = $RoundKey[($i-$nk)*4+2] ^ $temp[2];
  116. $RoundKey[$i*4+3] = $RoundKey[($i-$nk)*4+3] ^ $temp[3];
  117. ++$i;
  118. }
  119. }
  120. #------------------------------------------------------------------------------
  121. # This function adds the round key to state.
  122. # The round key is added to the state by an XOR function.
  123. sub AddRoundKey($)
  124. {
  125. my $round = shift;
  126. my ($i,$j);
  127. for ($i=0; $i<4; ++$i) {
  128. my $k = $round*16 + $i*4;
  129. for ($j=0; $j<4; ++$j) {
  130. $state[$j][$i] ^= $RoundKey[$k + $j];
  131. }
  132. }
  133. }
  134. #------------------------------------------------------------------------------
  135. # Substitute the values in the state matrix with values in an S-box
  136. sub SubBytes()
  137. {
  138. my $i;
  139. for ($i=0; $i<4; ++$i) {
  140. @{$state[$i]}[0..3] = @sbox[@{$state[$i]}[0..3]];
  141. }
  142. }
  143. sub InvSubBytes()
  144. {
  145. my $i;
  146. for ($i=0; $i<4; ++$i) {
  147. @{$state[$i]}[0..3] = @rsbox[@{$state[$i]}[0..3]];
  148. }
  149. }
  150. #------------------------------------------------------------------------------
  151. # Shift the rows in the state to the left.
  152. # Each row is shifted with different offset.
  153. # Offset = Row number. So the first row is not shifted.
  154. sub ShiftRows()
  155. {
  156. # rotate first row 1 columns to left
  157. @{$state[1]}[0,1,2,3] = @{$state[1]}[1,2,3,0];
  158. # rotate second row 2 columns to left
  159. @{$state[2]}[0,1,2,3] = @{$state[2]}[2,3,0,1];
  160. # rotate third row 3 columns to left
  161. @{$state[3]}[0,1,2,3] = @{$state[3]}[3,0,1,2];
  162. }
  163. sub InvShiftRows()
  164. {
  165. # rotate first row 1 columns to right
  166. @{$state[1]}[0,1,2,3] = @{$state[1]}[3,0,1,2];
  167. # rotate second row 2 columns to right
  168. @{$state[2]}[0,1,2,3] = @{$state[2]}[2,3,0,1];
  169. # rotate third row 3 columns to right
  170. @{$state[3]}[0,1,2,3] = @{$state[3]}[1,2,3,0];
  171. }
  172. #------------------------------------------------------------------------------
  173. # Find the product of {02} and the argument to xtime modulo 0x1b
  174. # Note: returns an integer which may need to be trimmed to 8 bits
  175. sub xtime($)
  176. {
  177. return ($_[0]<<1) ^ ((($_[0]>>7) & 1) * 0x1b);
  178. }
  179. #------------------------------------------------------------------------------
  180. # Multiply numbers in the field GF(2^8)
  181. sub Mult($$)
  182. {
  183. my ($x, $y) = @_;
  184. return (($y & 1) * $x) ^
  185. (($y>>1 & 1) * xtime($x)) ^
  186. (($y>>2 & 1) * xtime(xtime($x))) ^
  187. (($y>>3 & 1) * xtime(xtime(xtime($x)))) ^
  188. (($y>>4 & 1) * xtime(xtime(xtime(xtime($x)))));
  189. }
  190. #------------------------------------------------------------------------------
  191. # Mix the columns of the state matrix
  192. sub MixColumns()
  193. {
  194. my ($i,$t0,$t1,$t2);
  195. for ($i=0; $i<4; ++$i) {
  196. $t0 = $state[0][$i];
  197. $t2 = $state[0][$i] ^ $state[1][$i] ^ $state[2][$i] ^ $state[3][$i];
  198. $t1 = $state[0][$i] ^ $state[1][$i] ; $t1 = xtime($t1) & 0xff; $state[0][$i] ^= $t1 ^ $t2 ;
  199. $t1 = $state[1][$i] ^ $state[2][$i] ; $t1 = xtime($t1) & 0xff; $state[1][$i] ^= $t1 ^ $t2 ;
  200. $t1 = $state[2][$i] ^ $state[3][$i] ; $t1 = xtime($t1) & 0xff; $state[2][$i] ^= $t1 ^ $t2 ;
  201. $t1 = $state[3][$i] ^ $t0 ; $t1 = xtime($t1) & 0xff; $state[3][$i] ^= $t1 ^ $t2 ;
  202. }
  203. }
  204. sub InvMixColumns()
  205. {
  206. my $i;
  207. for ($i=0; $i<4; ++$i) {
  208. my $a = $state[0][$i];
  209. my $b = $state[1][$i];
  210. my $c = $state[2][$i];
  211. my $d = $state[3][$i];
  212. $state[0][$i] = (Mult($a,0x0e) ^ Mult($b,0x0b) ^ Mult($c,0x0d) ^ Mult($d,0x09)) & 0xff;
  213. $state[1][$i] = (Mult($a,0x09) ^ Mult($b,0x0e) ^ Mult($c,0x0b) ^ Mult($d,0x0d)) & 0xff;
  214. $state[2][$i] = (Mult($a,0x0d) ^ Mult($b,0x09) ^ Mult($c,0x0e) ^ Mult($d,0x0b)) & 0xff;
  215. $state[3][$i] = (Mult($a,0x0b) ^ Mult($b,0x0d) ^ Mult($c,0x09) ^ Mult($d,0x0e)) & 0xff;
  216. }
  217. }
  218. #------------------------------------------------------------------------------
  219. # Encrypt (Cipher) or decrypt (InvCipher) a block of data with CBC
  220. # Inputs: 0) string to cipher (must be 16 bytes long)
  221. # Returns: cipher'd string
  222. sub Cipher($)
  223. {
  224. my @in = unpack 'C*', $_[0]; # unpack input plaintext
  225. my ($i, $j, $round);
  226. # copy the input PlainText to state array and apply the CBC
  227. for ($i=0; $i<4; ++$i) {
  228. for ($j=0; $j<4; ++$j) {
  229. my $k = $i*4 + $j;
  230. $state[$j][$i] = $in[$k] ^ $cbc[$k];
  231. }
  232. }
  233. # add the First round key to the state before starting the rounds
  234. AddRoundKey(0);
  235. # there will be $nr rounds; the first $nr-1 rounds are identical
  236. for ($round=1; ; ++$round) {
  237. SubBytes();
  238. ShiftRows();
  239. if ($round < $nr) {
  240. MixColumns();
  241. AddRoundKey($round);
  242. } else {
  243. # MixColumns() is not used in the last round
  244. AddRoundKey($nr);
  245. last;
  246. }
  247. }
  248. # the encryption process is over
  249. # copy the state array to output array (and save for CBC)
  250. for ($i=0; $i<4; ++$i) {
  251. for ($j=0; $j<4; ++$j) {
  252. $cbc[$i*4+$j] = $state[$j][$i];
  253. }
  254. }
  255. return pack 'C*', @cbc; # return packed ciphertext
  256. }
  257. sub InvCipher($)
  258. {
  259. my @in = unpack 'C*', $_[0]; # unpack input ciphertext
  260. my (@out, $i, $j, $round);
  261. # copy the input CipherText to state array
  262. for ($i=0; $i<4; ++$i) {
  263. for ($j=0; $j<4; ++$j) {
  264. $state[$j][$i] = $in[$i*4 + $j];
  265. }
  266. }
  267. # add the First round key to the state before starting the rounds
  268. AddRoundKey($nr);
  269. # there will be $nr rounds; the first $nr-1 rounds are identical
  270. for ($round=$nr-1; ; --$round) {
  271. InvShiftRows();
  272. InvSubBytes();
  273. AddRoundKey($round);
  274. # InvMixColumns() is not used in the last round
  275. last if $round <= 0;
  276. InvMixColumns();
  277. }
  278. # copy the state array to output array and reverse the CBC
  279. for ($i=0; $i<4; ++$i) {
  280. for ($j=0; $j<4; ++$j) {
  281. my $k = $i*4 + $j;
  282. $out[$k] = $state[$j][$i] ^ $cbc[$k];
  283. }
  284. }
  285. @cbc = @in; # update CBC for next block
  286. return pack 'C*', @out; # return packed plaintext
  287. }
  288. #------------------------------------------------------------------------------
  289. # Encrypt/Decrypt using AES-CBC algorithm (with fixed 16-byte blocks)
  290. # Inputs: 0) data reference (with leading 16-byte initialization vector when decrypting)
  291. # 1) encryption key (16, 24 or 32 bytes for AES-128, AES-192 or AES-256)
  292. # 2) encrypt flag (false for decryption, true with length 16 bytes to
  293. # encrypt using this as the CBC IV, or true with other length to
  294. # encrypt with a randomly-generated IV)
  295. # 3) flag to disable padding
  296. # Returns: error string, or undef on success
  297. # Notes: encrypts/decrypts data in place (encrypted data returned with leading IV)
  298. sub Crypt($$;$$)
  299. {
  300. my ($dataPt, $key, $encrypt, $noPad) = @_;
  301. # validate key length
  302. my $keyLen = length $key;
  303. unless ($keyLen == 16 or $keyLen == 24 or $keyLen == 32) {
  304. return "Invalid AES key length ($keyLen)";
  305. }
  306. my $partLen = length($$dataPt) % 16;
  307. my ($pos, $i);
  308. if ($encrypt) {
  309. if (length($encrypt) == 16) {
  310. @cbc = unpack 'C*', $encrypt;
  311. } else {
  312. # generate a random 16-byte CBC initialization vector
  313. unless ($seeded) {
  314. srand(time() & ($$ + ($$<<15)));
  315. $seeded = 1;
  316. }
  317. for ($i=0; $i<16; ++$i) {
  318. $cbc[$i] = int(rand(256));
  319. }
  320. $encrypt = pack 'C*', @cbc;
  321. }
  322. $$dataPt = $encrypt . $$dataPt; # add IV to the start of the data
  323. # add required padding so we can recover the
  324. # original string length after decryption
  325. # (padding bytes have value set to padding length)
  326. my $padLen = 16 - $partLen;
  327. $$dataPt .= (chr($padLen)) x $padLen unless $padLen == 16 and $noPad;
  328. $pos = 16; # start encrypting at byte 16 (after the IV)
  329. } elsif ($partLen) {
  330. return 'Invalid AES ciphertext length';
  331. } elsif (length $$dataPt >= 32) {
  332. # take the CBC initialization vector from the start of the data
  333. @cbc = unpack 'C16', $$dataPt;
  334. $$dataPt = substr($$dataPt, 16);
  335. $pos = 0; # start decrypting from byte 0 (now that IV is removed)
  336. } else {
  337. $$dataPt = ''; # empty text
  338. return undef;
  339. }
  340. # the KeyExpansion routine must be called before encryption
  341. KeyExpansion($key);
  342. # loop through the data and convert in blocks
  343. my $dataLen = length $$dataPt;
  344. my $last = $dataLen - 16;
  345. my $func = $encrypt ? \&Cipher : \&InvCipher;
  346. while ($pos <= $last) {
  347. # cipher this block
  348. substr($$dataPt, $pos, 16) = &$func(substr($$dataPt, $pos, 16));
  349. $pos += 16;
  350. }
  351. unless ($encrypt or $noPad) {
  352. # remove padding if necessary (padding byte value gives length of padding)
  353. my $padLen = ord(substr($$dataPt, -1, 1));
  354. return 'AES decryption error (invalid pad byte)' if $padLen > 16;
  355. $$dataPt = substr($$dataPt, 0, $dataLen - $padLen);
  356. }
  357. return undef;
  358. }
  359. 1; # end
  360. __END__
  361. =head1 NAME
  362. Image::ExifTool::AES - AES encryption with cipher-block chaining
  363. =head1 SYNOPSIS
  364. use Image::ExifTool::AES qw(Crypt);
  365. $err = Crypt(\$plaintext, $key, 1); # encryption
  366. $err = Crypt(\$ciphertext, $key); # decryption
  367. =head1 DESCRIPTION
  368. This module contains an implementation of the AES encryption/decryption
  369. algorithms with cipher-block chaining (CBC) and RFC 2898 PKCS #5 padding.
  370. This is the AESV2 and AESV3 encryption mode used in PDF documents.
  371. =head1 EXPORTS
  372. Exports nothing by default, but L</Crypt> may be exported.
  373. =head1 METHODS
  374. =head2 Crypt
  375. Implement AES encryption/decryption with cipher-block chaining.
  376. =over 4
  377. =item Inputs:
  378. 0) Scalar reference for data to encrypt/decrypt.
  379. 1) Encryption key string (must have length 16, 24 or 32).
  380. 2) [optional] Encrypt flag (false to decrypt).
  381. 3) [optional] Flag to avoid removing padding after decrypting, or to avoid
  382. adding 16 bytes of padding before encrypting when data length is already a
  383. multiple of 16 bytes.
  384. =item Returns:
  385. On success, the return value is undefined and the data is encrypted or
  386. decrypted as specified. Otherwise returns an error string and the data is
  387. left in an indeterminate state.
  388. =item Notes:
  389. The length of the encryption key dictates the AES mode, with lengths of 16,
  390. 24 and 32 bytes resulting in AES-128, AES-192 and AES-256.
  391. When encrypting, the input data may be any length and will be padded to an
  392. even 16-byte block size using the specified padding technique. If the
  393. encrypt flag has length 16, it is used as the initialization vector for
  394. the cipher-block chaining, otherwise a random IV is generated. Upon
  395. successful return the data will be encrypted, with the first 16 bytes of
  396. the data being the CBC IV.
  397. When decrypting, the input data begins with the 16-byte CBC initialization
  398. vector.
  399. =back
  400. =head1 BUGS
  401. This code is blindingly slow. But in truth, slowing down processing is the
  402. main purpose of encryption, so this really can't be considered a bug.
  403. =head1 AUTHOR
  404. Copyright 2003-2016, Phil Harvey (phil at owl.phy.queensu.ca)
  405. This library is free software; you can redistribute it and/or modify it
  406. under the same terms as Perl itself.
  407. =head1 REFERENCES
  408. =over 4
  409. =item L<http://www.hoozi.com/Articles/AESEncryption.htm>
  410. =item L<http://www.csrc.nist.gov/publications/fips/fips197/fips-197.pdf>
  411. =item L<http://www.faqs.org/rfcs/rfc3602.html>
  412. =back
  413. =head1 SEE ALSO
  414. L<Image::ExifTool(3pm)|Image::ExifTool>
  415. =cut