-1
$\begingroup$

I'm implementing AES-256 in JavaScript with block size 128 bits and I understand every thing about AES except MixColumn transformation.

So I copied this code from the internet and both MixColumn and InvMixColumn transformation works perfectly against each other but the problem is the MixColumn code is generating bytes in the block bigger than 8 bits which is not being accepted by the other functions like SubBytes etc.

AES.prototype.TEMPMixColumns = function(state)
{
  var i, Tmp, Tm, t;
  for (i = 0; i < 4; ++i)
  {  
    t   = state[i*4];
    Tmp = state[i*4] ^ state[i*4+1] ^ state[i*4+2] ^ state[i*4+3] ;
    Tm  = state[i*4] ^ state[i*4+1]  ;
    Tm = this.xtime(Tm);  
    state[i*4+0] ^= Tm ^ Tmp ;
    Tm  = state[i*4+1] ^ state[i*4+2] ; Tm = this.xtime(Tm);  state[i*4+1]     ^= Tm ^ Tmp ;
    Tm  = state[i*4+2] ^ state[i*4+3] ; Tm = this.xtime(Tm);  state[i*4+2] ^= Tm ^ Tmp ;
    Tm  = state[i*4+3] ^ t ;              Tm = this.xtime(Tm);  state[i*4+3] ^= Tm ^ Tmp ;


  }
  return state
}

AES.prototype.xtime = function(x){ 
    return ((x << 1) ^ (((x >> 7) & 1) * 0x1b)) 
}

AES.prototype.Multiply = function(x, y){
    var t =  (((y & 1) * x) ^ ((y >> 1 & 1) * this.xtime(x)) ^ ((y >> 2 & 1) * this.xtime(this.xtime(x))) ^ ((y >> 3 & 1) * this.xtime(this.xtime(this.xtime(x)))) ^ ((y >> 4 & 1) * this.xtime(this.xtime(this.xtime(this.xtime(x))))));
    return t;
}

AES.prototype.TEMPInvMixColumns = function( state)
{
  var i, a, b, c, d;
  for (i = 0; i < 4; ++i)
  { 
a = state[i*4+0];
b = state[i*4+1];
c = state[i*4+2];
d = state[i*4+3];

state[i*4+0] = this.Multiply(a, 0x0e) ^ this.Multiply(b, 0x0b) ^ this.Multiply(c, 0x0d) ^ this.Multiply(d, 0x09);
state[i*4+1] = this.Multiply(a, 0x09) ^ this.Multiply(b, 0x0e) ^ this.Multiply(c, 0x0b) ^ this.Multiply(d, 0x0d);
state[i*4+2] = this.Multiply(a, 0x0d) ^ this.Multiply(b, 0x09) ^ this.Multiply(c, 0x0e) ^ this.Multiply(d, 0x0b);
state[i*4+3] = this.Multiply(a, 0x0b) ^ this.Multiply(b, 0x0d) ^ this.Multiply(c, 0x09) ^ this.Multiply(d, 0x0e) ;
  }
  return state
}

Everything else in the program is working fine but I don't understand MixColumn transformation so I can't debug this and I have no idea why it is producing bigger output.

$\endgroup$
3
$\begingroup$

I believe the problem is here:

AES.prototype.xtime = function(x){ 
    return ((x << 1) ^ (((x >> 7) & 1) * 0x1b)) 
}

This code appears to assume that somehow the return value is being truncated 8 bits; I suspect that's not true for your implementation.

If you change this to:

AES.prototype.xtime = function(x){ 
    return (((x << 1) & 0xfe) ^ (((x >> 7) & 1) * 0x1b)) 
}

it might work as expected...

$\endgroup$

Not the answer you're looking for? Browse other questions tagged or ask your own question.