1
// Copyright 2012 The Closure Library Authors. All Rights Reserved.
2
//
3
// Licensed under the Apache License, Version 2.0 (the "License");
4
// you may not use this file except in compliance with the License.
5
// You may obtain a copy of the License at
6
//
7
//      http://www.apache.org/licenses/LICENSE-2.0
8
//
9
// Unless required by applicable law or agreed to in writing, software
10
// distributed under the License is distributed on an "AS-IS" BASIS,
11
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12
// See the License for the specific language governing permissions and
13
// limitations under the License.
14

15
/**
16
 * @fileoverview Implementation of AES in JavaScript.
17
 * @see http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
18
 *
19
 * @author [email protected] (Nathan Naze) - port to Closure
20
 */
21

22
goog.provide('goog.crypt.Aes');
23

24
goog.require('goog.asserts');
25
goog.require('goog.crypt.BlockCipher');
26

27

28

29
/**
30
 * Implementation of AES in JavaScript.
31
 * See http://en.wikipedia.org/wiki/Advanced_Encryption_Standard
32
 *
33
 * WARNING: This is ECB mode only. If you are encrypting something
34
 * longer than 16 bytes, or encrypting more than one value with the same key
35
 * (so basically, always) you need to use this with a block cipher mode of
36
 * operation.  See goog.crypt.Cbc.
37
 *
38
 * See http://en.wikipedia.org/wiki/Block_cipher_modes_of_operation for more
39
 * information.
40
 *
41
 * @constructor
42
 * @implements {goog.crypt.BlockCipher}
43
 * @param {!Array<number>} key The key as an array of integers in {0, 255}.
44
 *     The key must have lengths of 16, 24, or 32 integers for 128-,
45
 *     192-, or 256-bit encryption, respectively.
46
 * @final
47
 * @struct
48
 */
49
goog.crypt.Aes = function(key) {
50
  goog.crypt.Aes.assertKeyArray_(key);
51

52
  /**
53
   * The AES key.
54
   * @type {!Array<number>}
55
   * @private
56
   */
57
  this.key_ = key;
58

59
  /**
60
   * Key length, in words.
61
   * @type {number}
62
   * @private
63
   */
64
  this.keyLengthInWords_ = this.key_.length / 4;
65

66
  /**
67
   * Number of rounds.  Based on key length per AES spec.
68
   * @type {number}
69
   * @private
70
   */
71
  this.numberOfRounds_ = this.keyLengthInWords_ + 6;
72

73
  /**
74
   * 4x4 byte array containing the current state.
75
   * @type {!Array<!Array<number>>}
76
   * @private
77
   */
78
  this.state_ = [[], [], [], []];
79

80
  /**
81
   * Scratch temporary array for calculation.
82
   * @type {!Array<!Array<number>>}
83
   * @private
84
   */
85
  this.temp_ = [[], [], [], []];
86

87
  /**
88
   * The key schedule.
89
   * @type {!Array<!Array<number>>}
90
   * @private
91
   */
92
  this.keySchedule_;
93

94
  this.keyExpansion_();
95
};
96

97

98
/**
99
 * Block size, in bytes.  Fixed at 16 per AES spec.
100
 * @override
101
 * @type {number}
102
 * @const
103
 * @public
104
 */
105
goog.crypt.Aes.prototype.BLOCK_SIZE = 16;
106

107
/**
108
 * Number of words in a block.
109
 * @type {number}
110
 * @const
111
 * @private
112
 */
113
goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_ = goog.crypt.Aes.prototype.BLOCK_SIZE / 4;
114

115

116
/**
117
 * @define {boolean} Whether to call test method stubs.  This can be enabled
118
 *     for unit testing.
119
 */
120
goog.define('goog.crypt.Aes.ENABLE_TEST_MODE', false);
121

122

123
/**
124
 * @override
125
 */
126
goog.crypt.Aes.prototype.encrypt = function(input) {
127

128
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
129
    this.testKeySchedule_(0, this.keySchedule_, 0);
130
  }
131

132
  this.copyInput_(input);
133
  this.addRoundKey_(0);
134

135
  for (var round = 1; round < this.numberOfRounds_; ++round) {
136
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
137
      this.testKeySchedule_(round, this.keySchedule_, round);
138
      this.testStartRound_(round, this.state_);
139
    }
140

141
    this.subBytes_(goog.crypt.Aes.SBOX_);
142
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
143
      this.testAfterSubBytes_(round, this.state_);
144
    }
145

146
    this.shiftRows_();
147
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
148
      this.testAfterShiftRows_(round, this.state_);
149
    }
150

151
    this.mixColumns_();
152
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
153
      this.testAfterMixColumns_(round, this.state_);
154
    }
155

156
    this.addRoundKey_(round);
157
  }
158

159
  this.subBytes_(goog.crypt.Aes.SBOX_);
160
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
161
    this.testAfterSubBytes_(round, this.state_);
162
  }
163

164
  this.shiftRows_();
165
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
166
    this.testAfterShiftRows_(round, this.state_);
167
  }
168

169
  this.addRoundKey_(this.numberOfRounds_);
170

171
  return this.generateOutput_();
172
};
173

174

175
/**
176
 * @override
177
 */
178
goog.crypt.Aes.prototype.decrypt = function(input) {
179

180
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
181
    this.testKeySchedule_(0, this.keySchedule_, this.numberOfRounds_);
182
  }
183

184
  this.copyInput_(input);
185
  this.addRoundKey_(this.numberOfRounds_);
186

187
  for (var round = 1; round < this.numberOfRounds_; ++round) {
188
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
189
      this.testKeySchedule_(
190
          round, this.keySchedule_, this.numberOfRounds_ - round);
191
      this.testStartRound_(round, this.state_);
192
    }
193

194
    this.invShiftRows_();
195
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
196
      this.testAfterShiftRows_(round, this.state_);
197
    }
198

199
    this.subBytes_(goog.crypt.Aes.INV_SBOX_);
200
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
201
      this.testAfterSubBytes_(round, this.state_);
202
    }
203

204
    this.addRoundKey_(this.numberOfRounds_ - round);
205
    if (goog.crypt.Aes.ENABLE_TEST_MODE) {
206
      this.testAfterAddRoundKey_(round, this.state_);
207
    }
208

209
    this.invMixColumns_();
210
  }
211

212
  this.invShiftRows_();
213
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
214
    this.testAfterShiftRows_(round, this.state_);
215
  }
216

217
  this.subBytes_(goog.crypt.Aes.INV_SBOX_);
218
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
219
    this.testAfterSubBytes_(this.numberOfRounds_, this.state_);
220
  }
221

222
  if (goog.crypt.Aes.ENABLE_TEST_MODE) {
223
    this.testKeySchedule_(this.numberOfRounds_, this.keySchedule_, 0);
224
  }
225

226
  this.addRoundKey_(0);
227

228
  return this.generateOutput_();
229
};
230

231

232
/**
233
 * Asserts that the key's array of integers is in the correct format.
234
 * @param {!Array<number>} arr AES key as array of integers.
235
 * @private
236
 */
237
goog.crypt.Aes.assertKeyArray_ = function(arr) {
238
  if (goog.asserts.ENABLE_ASSERTS) {
239
    goog.asserts.assert(
240
        arr.length == 16 || arr.length == 24 || arr.length == 32,
241
        'Key must have length 16, 24, or 32.');
242
    for (var i = 0; i < arr.length; i++) {
243
      goog.asserts.assertNumber(arr[i]);
244
      goog.asserts.assert(arr[i] >= 0 && arr[i] <= 255);
245
    }
246
  }
247
};
248

249

250
/**
251
 * Tests can populate this with a callback, and that callback will get called
252
 * at the start of each round *in both functions encrypt() and decrypt()*.
253
 * @param {number} roundNum Round number.
254
 * @param {!Array<Array<number>>} Current state.
255
 * @private
256
 */
257
goog.crypt.Aes.prototype.testStartRound_ = goog.nullFunction;
258

259

260
/**
261
 * Tests can populate this with a callback, and that callback will get called
262
 * each round right after the SubBytes step gets executed *in both functions
263
 * encrypt() and decrypt()*.
264
 * @param {number} roundNum Round number.
265
 * @param {!Array<Array<number>>} Current state.
266
 * @private
267
 */
268
goog.crypt.Aes.prototype.testAfterSubBytes_ = goog.nullFunction;
269

270

271
/**
272
 * Tests can populate this with a callback, and that callback will get called
273
 * each round right after the ShiftRows step gets executed *in both functions
274
 * encrypt() and decrypt()*.
275
 * @param {number} roundNum Round number.
276
 * @param {!Array<Array<number>>} Current state.
277
 * @private
278
 */
279
goog.crypt.Aes.prototype.testAfterShiftRows_ = goog.nullFunction;
280

281

282
/**
283
 * Tests can populate this with a callback, and that callback will get called
284
 * each round right after the MixColumns step gets executed *but only in the
285
 * decrypt() function*.
286
 * @param {number} roundNum Round number.
287
 * @param {!Array<Array<number>>} Current state.
288
 * @private
289
 */
290
goog.crypt.Aes.prototype.testAfterMixColumns_ = goog.nullFunction;
291

292

293
/**
294
 * Tests can populate this with a callback, and that callback will get called
295
 * each round right after the AddRoundKey step gets executed  encrypt().
296
 * @param {number} roundNum Round number.
297
 * @param {!Array<Array<number>>} Current state.
298
 * @private
299
 */
300
goog.crypt.Aes.prototype.testAfterAddRoundKey_ = goog.nullFunction;
301

302

303
/**
304
 * Tests can populate this with a callback, and that callback will get called
305
 * before each round on the round key.  *Gets called in both the encrypt() and
306
 * decrypt() functions.*
307
 * @param {number} roundNum Round number.
308
 * @param {Array<!Array<number>>} Computed key schedule.
309
 * @param {number} index The index into the key schedule to test. This is not
310
 *     necessarily roundNum because the key schedule is used in reverse
311
 *     in the case of decryption.
312
 * @private
313
 */
314
goog.crypt.Aes.prototype.testKeySchedule_ = goog.nullFunction;
315

316

317
/**
318
 * Helper to copy input into the AES state matrix.
319
 * @param {!Array<number>|!Uint8Array} input Byte array to copy into the state
320
 *     matrix.
321
 * @private
322
 */
323
goog.crypt.Aes.prototype.copyInput_ = function(input) {
324
  var v, p;
325

326
  goog.asserts.assert(
327
      input.length == this.BLOCK_SIZE, 'Expecting input of block size.');
328

329
  for (var r = 0; r < goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_; r++) {
330
    for (var c = 0; c < 4; c++) {
331
      p = c * 4 + r;
332
      v = input[p];
333

334
      goog.asserts.assert(
335
          v <= 255 && v >= 0,
336
          'Invalid input. Value %s at position %s is not a byte.', v, p);
337

338
      this.state_[r][c] = v;
339
    }
340
  }
341
};
342

343

344
/**
345
 * Helper to copy the state matrix into an output array.
346
 * @return {!Array<number>} Output byte array.
347
 * @private
348
 */
349
goog.crypt.Aes.prototype.generateOutput_ = function() {
350
  var output = [];
351
  for (var r = 0; r < goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_; r++) {
352
    for (var c = 0; c < 4; c++) {
353
      output[c * 4 + r] = this.state_[r][c];
354
    }
355
  }
356
  return output;
357
};
358

359

360
/**
361
 * AES's AddRoundKey procedure. Add the current round key to the state.
362
 * @param {number} round The current round.
363
 * @private
364
 */
365
goog.crypt.Aes.prototype.addRoundKey_ = function(round) {
366
  for (var r = 0; r < 4; r++) {
367
    for (var c = 0; c < 4; c++) {
368
      this.state_[r][c] ^= this.keySchedule_[round * 4 + c][r];
369
    }
370
  }
371
};
372

373

374
/**
375
 * AES's SubBytes procedure. Substitute bytes from the precomputed SBox lookup
376
 * into the state.
377
 * @param {!Array<number>} box The SBox or invSBox.
378
 * @private
379
 */
380
goog.crypt.Aes.prototype.subBytes_ = function(box) {
381
  for (var r = 0; r < 4; r++) {
382
    for (var c = 0; c < 4; c++) {
383
      this.state_[r][c] = box[this.state_[r][c]];
384
    }
385
  }
386
};
387

388

389
/**
390
 * AES's ShiftRows procedure. Shift the values in each row to the right. Each
391
 * row is shifted one more slot than the one above it.
392
 * @private
393
 */
394
goog.crypt.Aes.prototype.shiftRows_ = function() {
395
  for (var r = 1; r < 4; r++) {
396
    for (var c = 0; c < 4; c++) {
397
      this.temp_[r][c] = this.state_[r][c];
398
    }
399
  }
400

401
  for (var r = 1; r < 4; r++) {
402
    for (var c = 0; c < 4; c++) {
403
      this.state_[r][c] =
404
          this.temp_[r][(c + r) % goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_];
405
    }
406
  }
407
};
408

409

410
/**
411
 * AES's InvShiftRows procedure. Shift the values in each row to the right.
412
 * @private
413
 */
414
goog.crypt.Aes.prototype.invShiftRows_ = function() {
415
  for (var r = 1; r < 4; r++) {
416
    for (var c = 0; c < 4; c++) {
417
      this.temp_[r][(c + r) % goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_] =
418
          this.state_[r][c];
419
    }
420
  }
421

422
  for (var r = 1; r < 4; r++) {
423
    for (var c = 0; c < 4; c++) {
424
      this.state_[r][c] = this.temp_[r][c];
425
    }
426
  }
427
};
428

429

430
/**
431
 * AES's MixColumns procedure. Mix the columns of the state using magic.
432
 * @private
433
 */
434
goog.crypt.Aes.prototype.mixColumns_ = function() {
435
  var s = this.state_;
436
  var t = this.temp_[0];
437

438
  for (var c = 0; c < 4; c++) {
439
    t[0] = s[0][c];
440
    t[1] = s[1][c];
441
    t[2] = s[2][c];
442
    t[3] = s[3][c];
443

444
    s[0][c] =
445
        (goog.crypt.Aes.MULT_2_[t[0]] ^ goog.crypt.Aes.MULT_3_[t[1]] ^ t[2] ^
446
         t[3]);
447
    s[1][c] =
448
        (t[0] ^ goog.crypt.Aes.MULT_2_[t[1]] ^ goog.crypt.Aes.MULT_3_[t[2]] ^
449
         t[3]);
450
    s[2][c] =
451
        (t[0] ^ t[1] ^ goog.crypt.Aes.MULT_2_[t[2]] ^
452
         goog.crypt.Aes.MULT_3_[t[3]]);
453
    s[3][c] =
454
        (goog.crypt.Aes.MULT_3_[t[0]] ^ t[1] ^ t[2] ^
455
         goog.crypt.Aes.MULT_2_[t[3]]);
456
  }
457
};
458

459

460
/**
461
 * AES's InvMixColumns procedure.
462
 * @private
463
 */
464
goog.crypt.Aes.prototype.invMixColumns_ = function() {
465
  var s = this.state_;
466
  var t = this.temp_[0];
467

468
  for (var c = 0; c < 4; c++) {
469
    t[0] = s[0][c];
470
    t[1] = s[1][c];
471
    t[2] = s[2][c];
472
    t[3] = s[3][c];
473

474
    s[0][c] =
475
        (goog.crypt.Aes.MULT_E_[t[0]] ^ goog.crypt.Aes.MULT_B_[t[1]] ^
476
         goog.crypt.Aes.MULT_D_[t[2]] ^ goog.crypt.Aes.MULT_9_[t[3]]);
477

478
    s[1][c] =
479
        (goog.crypt.Aes.MULT_9_[t[0]] ^ goog.crypt.Aes.MULT_E_[t[1]] ^
480
         goog.crypt.Aes.MULT_B_[t[2]] ^ goog.crypt.Aes.MULT_D_[t[3]]);
481

482
    s[2][c] =
483
        (goog.crypt.Aes.MULT_D_[t[0]] ^ goog.crypt.Aes.MULT_9_[t[1]] ^
484
         goog.crypt.Aes.MULT_E_[t[2]] ^ goog.crypt.Aes.MULT_B_[t[3]]);
485

486
    s[3][c] =
487
        (goog.crypt.Aes.MULT_B_[t[0]] ^ goog.crypt.Aes.MULT_D_[t[1]] ^
488
         goog.crypt.Aes.MULT_9_[t[2]] ^ goog.crypt.Aes.MULT_E_[t[3]]);
489
  }
490
};
491

492

493
/**
494
 * AES's KeyExpansion procedure. Create the key schedule from the initial key.
495
 * @private
496
 */
497
goog.crypt.Aes.prototype.keyExpansion_ = function() {
498
  this.keySchedule_ = new Array(
499
      goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_ * (this.numberOfRounds_ + 1));
500

501
  for (var rowNum = 0; rowNum < this.keyLengthInWords_; rowNum++) {
502
    this.keySchedule_[rowNum] = [
503
      this.key_[4 * rowNum], this.key_[4 * rowNum + 1],
504
      this.key_[4 * rowNum + 2], this.key_[4 * rowNum + 3]
505
    ];
506
  }
507

508
  var temp = new Array(4);
509

510
  for (var rowNum = this.keyLengthInWords_; rowNum <
511
       (goog.crypt.Aes.BLOCK_SIZE_IN_WORDS_ * (this.numberOfRounds_ + 1));
512
       rowNum++) {
513
    temp[0] = this.keySchedule_[rowNum - 1][0];
514
    temp[1] = this.keySchedule_[rowNum - 1][1];
515
    temp[2] = this.keySchedule_[rowNum - 1][2];
516
    temp[3] = this.keySchedule_[rowNum - 1][3];
517

518
    if (rowNum % this.keyLengthInWords_ == 0) {
519
      this.rotWord_(temp);
520
      this.subWord_(temp);
521

522
      temp[0] ^= goog.crypt.Aes.RCON_[rowNum / this.keyLengthInWords_][0];
523
      temp[1] ^= goog.crypt.Aes.RCON_[rowNum / this.keyLengthInWords_][1];
524
      temp[2] ^= goog.crypt.Aes.RCON_[rowNum / this.keyLengthInWords_][2];
525
      temp[3] ^= goog.crypt.Aes.RCON_[rowNum / this.keyLengthInWords_][3];
526
    } else if (
527
        this.keyLengthInWords_ > 6 && rowNum % this.keyLengthInWords_ == 4) {
528
      this.subWord_(temp);
529
    }
530

531
    this.keySchedule_[rowNum] = new Array(4);
532
    this.keySchedule_[rowNum][0] =
533
        this.keySchedule_[rowNum - this.keyLengthInWords_][0] ^ temp[0];
534
    this.keySchedule_[rowNum][1] =
535
        this.keySchedule_[rowNum - this.keyLengthInWords_][1] ^ temp[1];
536
    this.keySchedule_[rowNum][2] =
537
        this.keySchedule_[rowNum - this.keyLengthInWords_][2] ^ temp[2];
538
    this.keySchedule_[rowNum][3] =
539
        this.keySchedule_[rowNum - this.keyLengthInWords_][3] ^ temp[3];
540
  }
541
};
542

543

544
/**
545
 * AES's SubWord procedure.
546
 * @param {!Array<number>} w Bytes to find the SBox substitution for.
547
 * @return {!Array<number>} The substituted bytes.
548
 * @private
549
 */
550
goog.crypt.Aes.prototype.subWord_ = function(w) {
551
  w[0] = goog.crypt.Aes.SBOX_[w[0]];
552
  w[1] = goog.crypt.Aes.SBOX_[w[1]];
553
  w[2] = goog.crypt.Aes.SBOX_[w[2]];
554
  w[3] = goog.crypt.Aes.SBOX_[w[3]];
555

556
  return w;
557
};
558

559

560
/**
561
 * AES's RotWord procedure.
562
 * @param {!Array<number>} w Array of bytes to rotate.
563
 * @return {!Array<number>} The rotated bytes.
564
 * @private
565
 */
566
goog.crypt.Aes.prototype.rotWord_ = function(w) {
567
  var temp = w[0];
568

569
  w[0] = w[1];
570
  w[1] = w[2];
571
  w[2] = w[3];
572
  w[3] = temp;
573

574
  return w;
575
};
576

577
// clang-format off
578
/**
579
 * Precomputed SBox lookup.
580
 * @type {!Array<number>}
581
 * @private
582
 */
583
goog.crypt.Aes.SBOX_ = [
584
  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe,
585
  0xd7, 0xab, 0x76,
586

587
  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c,
588
  0xa4, 0x72, 0xc0,
589

590
  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71,
591
  0xd8, 0x31, 0x15,
592

593
  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb,
594
  0x27, 0xb2, 0x75,
595

596
  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29,
597
  0xe3, 0x2f, 0x84,
598

599
  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a,
600
  0x4c, 0x58, 0xcf,
601

602
  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50,
603
  0x3c, 0x9f, 0xa8,
604

605
  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10,
606
  0xff, 0xf3, 0xd2,
607

608
  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64,
609
  0x5d, 0x19, 0x73,
610

611
  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde,
612
  0x5e, 0x0b, 0xdb,
613

614
  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91,
615
  0x95, 0xe4, 0x79,
616

617
  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65,
618
  0x7a, 0xae, 0x08,
619

620
  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b,
621
  0xbd, 0x8b, 0x8a,
622

623
  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86,
624
  0xc1, 0x1d, 0x9e,
625

626
  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce,
627
  0x55, 0x28, 0xdf,
628

629
  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0,
630
  0x54, 0xbb, 0x16
631
];
632

633

634
/**
635
 * Precomputed InvSBox lookup.
636
 * @type {!Array<number>}
637
 * @private
638
 */
639
goog.crypt.Aes.INV_SBOX_ = [
640
  0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81,
641
  0xf3, 0xd7, 0xfb,
642

643
  0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4,
644
  0xde, 0xe9, 0xcb,
645

646
  0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42,
647
  0xfa, 0xc3, 0x4e,
648

649
  0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d,
650
  0x8b, 0xd1, 0x25,
651

652
  0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d,
653
  0x65, 0xb6, 0x92,
654

655
  0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7,
656
  0x8d, 0x9d, 0x84,
657

658
  0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8,
659
  0xb3, 0x45, 0x06,
660

661
  0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01,
662
  0x13, 0x8a, 0x6b,
663

664
  0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0,
665
  0xb4, 0xe6, 0x73,
666

667
  0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c,
668
  0x75, 0xdf, 0x6e,
669

670
  0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa,
671
  0x18, 0xbe, 0x1b,
672

673
  0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78,
674
  0xcd, 0x5a, 0xf4,
675

676
  0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27,
677
  0x80, 0xec, 0x5f,
678

679
  0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93,
680
  0xc9, 0x9c, 0xef,
681

682
  0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83,
683
  0x53, 0x99, 0x61,
684

685
  0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55,
686
  0x21, 0x0c, 0x7d
687
];
688

689

690
/**
691
 * Precomputed RCon lookup.
692
 * @type {!Array<!Array<number>>}
693
 * @private
694
 */
695
goog.crypt.Aes.RCON_ = [
696
  [0x00, 0x00, 0x00, 0x00],
697
  [0x01, 0x00, 0x00, 0x00],
698
  [0x02, 0x00, 0x00, 0x00],
699
  [0x04, 0x00, 0x00, 0x00],
700
  [0x08, 0x00, 0x00, 0x00],
701
  [0x10, 0x00, 0x00, 0x00],
702
  [0x20, 0x00, 0x00, 0x00],
703
  [0x40, 0x00, 0x00, 0x00],
704
  [0x80, 0x00, 0x00, 0x00],
705
  [0x1b, 0x00, 0x00, 0x00],
706
  [0x36, 0x00, 0x00, 0x00]
707
];
708

709

710
/**
711
 * Precomputed lookup of multiplication by 2 in GF(2^8)
712
 * @type {!Array<number>}
713
 * @private
714
 */
715
goog.crypt.Aes.MULT_2_ = [
716
  0x00, 0x02, 0x04, 0x06, 0x08, 0x0A, 0x0C, 0x0E, 0x10, 0x12, 0x14, 0x16,
717
  0x18, 0x1A, 0x1C, 0x1E,
718

719
  0x20, 0x22, 0x24, 0x26, 0x28, 0x2A, 0x2C, 0x2E, 0x30, 0x32, 0x34, 0x36,
720
  0x38, 0x3A, 0x3C, 0x3E,
721

722
  0x40, 0x42, 0x44, 0x46, 0x48, 0x4A, 0x4C, 0x4E, 0x50, 0x52, 0x54, 0x56,
723
  0x58, 0x5A, 0x5C, 0x5E,
724

725
  0x60, 0x62, 0x64, 0x66, 0x68, 0x6A, 0x6C, 0x6E, 0x70, 0x72, 0x74, 0x76,
726
  0x78, 0x7A, 0x7C, 0x7E,
727

728
  0x80, 0x82, 0x84, 0x86, 0x88, 0x8A, 0x8C, 0x8E, 0x90, 0x92, 0x94, 0x96,
729
  0x98, 0x9A, 0x9C, 0x9E,
730

731
  0xA0, 0xA2, 0xA4, 0xA6, 0xA8, 0xAA, 0xAC, 0xAE, 0xB0, 0xB2, 0xB4, 0xB6,
732
  0xB8, 0xBA, 0xBC, 0xBE,
733

734
  0xC0, 0xC2, 0xC4, 0xC6, 0xC8, 0xCA, 0xCC, 0xCE, 0xD0, 0xD2, 0xD4, 0xD6,
735
  0xD8, 0xDA, 0xDC, 0xDE,
736

737
  0xE0, 0xE2, 0xE4, 0xE6, 0xE8, 0xEA, 0xEC, 0xEE, 0xF0, 0xF2, 0xF4, 0xF6,
738
  0xF8, 0xFA, 0xFC, 0xFE,
739

740
  0x1B, 0x19, 0x1F, 0x1D, 0x13, 0x11, 0x17, 0x15, 0x0B, 0x09, 0x0F, 0x0D,
741
  0x03, 0x01, 0x07, 0x05,
742

743
  0x3B, 0x39, 0x3F, 0x3D, 0x33, 0x31, 0x37, 0x35, 0x2B, 0x29, 0x2F, 0x2D,
744
  0x23, 0x21, 0x27, 0x25,
745

746
  0x5B, 0x59, 0x5F, 0x5D, 0x53, 0x51, 0x57, 0x55, 0x4B, 0x49, 0x4F, 0x4D,
747
  0x43, 0x41, 0x47, 0x45,
748

749
  0x7B, 0x79, 0x7F, 0x7D, 0x73, 0x71, 0x77, 0x75, 0x6B, 0x69, 0x6F, 0x6D,
750
  0x63, 0x61, 0x67, 0x65,
751

752
  0x9B, 0x99, 0x9F, 0x9D, 0x93, 0x91, 0x97, 0x95, 0x8B, 0x89, 0x8F, 0x8D,
753
  0x83, 0x81, 0x87, 0x85,
754

755
  0xBB, 0xB9, 0xBF, 0xBD, 0xB3, 0xB1, 0xB7, 0xB5, 0xAB, 0xA9, 0xAF, 0xAD,
756
  0xA3, 0xA1, 0xA7, 0xA5,
757

758
  0xDB, 0xD9, 0xDF, 0xDD, 0xD3, 0xD1, 0xD7, 0xD5, 0xCB, 0xC9, 0xCF, 0xCD,
759
  0xC3, 0xC1, 0xC7, 0xC5,
760

761
  0xFB, 0xF9, 0xFF, 0xFD, 0xF3, 0xF1, 0xF7, 0xF5, 0xEB, 0xE9, 0xEF, 0xED,
762
  0xE3, 0xE1, 0xE7, 0xE5
763
];
764

765

766
/**
767
 * Precomputed lookup of multiplication by 3 in GF(2^8)
768
 * @type {!Array<number>}
769
 * @private
770
 */
771
goog.crypt.Aes.MULT_3_ = [
772
  0x00, 0x03, 0x06, 0x05, 0x0C, 0x0F, 0x0A, 0x09, 0x18, 0x1B, 0x1E, 0x1D,
773
  0x14, 0x17, 0x12, 0x11,
774

775
  0x30, 0x33, 0x36, 0x35, 0x3C, 0x3F, 0x3A, 0x39, 0x28, 0x2B, 0x2E, 0x2D,
776
  0x24, 0x27, 0x22, 0x21,
777

778
  0x60, 0x63, 0x66, 0x65, 0x6C, 0x6F, 0x6A, 0x69, 0x78, 0x7B, 0x7E, 0x7D,
779
  0x74, 0x77, 0x72, 0x71,
780

781
  0x50, 0x53, 0x56, 0x55, 0x5C, 0x5F, 0x5A, 0x59, 0x48, 0x4B, 0x4E, 0x4D,
782
  0x44, 0x47, 0x42, 0x41,
783

784
  0xC0, 0xC3, 0xC6, 0xC5, 0xCC, 0xCF, 0xCA, 0xC9, 0xD8, 0xDB, 0xDE, 0xDD,
785
  0xD4, 0xD7, 0xD2, 0xD1,
786

787
  0xF0, 0xF3, 0xF6, 0xF5, 0xFC, 0xFF, 0xFA, 0xF9, 0xE8, 0xEB, 0xEE, 0xED,
788
  0xE4, 0xE7, 0xE2, 0xE1,
789

790
  0xA0, 0xA3, 0xA6, 0xA5, 0xAC, 0xAF, 0xAA, 0xA9, 0xB8, 0xBB, 0xBE, 0xBD,
791
  0xB4, 0xB7, 0xB2, 0xB1,
792

793
  0x90, 0x93, 0x96, 0x95, 0x9C, 0x9F, 0x9A, 0x99, 0x88, 0x8B, 0x8E, 0x8D,
794
  0x84, 0x87, 0x82, 0x81,
795

796
  0x9B, 0x98, 0x9D, 0x9E, 0x97, 0x94, 0x91, 0x92, 0x83, 0x80, 0x85, 0x86,
797
  0x8F, 0x8C, 0x89, 0x8A,
798

799
  0xAB, 0xA8, 0xAD, 0xAE, 0xA7, 0xA4, 0xA1, 0xA2, 0xB3, 0xB0, 0xB5, 0xB6,
800
  0xBF, 0xBC, 0xB9, 0xBA,
801

802
  0xFB, 0xF8, 0xFD, 0xFE, 0xF7, 0xF4, 0xF1, 0xF2, 0xE3, 0xE0, 0xE5, 0xE6,
803
  0xEF, 0xEC, 0xE9, 0xEA,
804

805
  0xCB, 0xC8, 0xCD, 0xCE, 0xC7, 0xC4, 0xC1, 0xC2, 0xD3, 0xD0, 0xD5, 0xD6,
806
  0xDF, 0xDC, 0xD9, 0xDA,
807

808
  0x5B, 0x58, 0x5D, 0x5E, 0x57, 0x54, 0x51, 0x52, 0x43, 0x40, 0x45, 0x46,
809
  0x4F, 0x4C, 0x49, 0x4A,
810

811
  0x6B, 0x68, 0x6D, 0x6E, 0x67, 0x64, 0x61, 0x62, 0x73, 0x70, 0x75, 0x76,
812
  0x7F, 0x7C, 0x79, 0x7A,
813

814
  0x3B, 0x38, 0x3D, 0x3E, 0x37, 0x34, 0x31, 0x32, 0x23, 0x20, 0x25, 0x26,
815
  0x2F, 0x2C, 0x29, 0x2A,
816

817
  0x0B, 0x08, 0x0D, 0x0E, 0x07, 0x04, 0x01, 0x02, 0x13, 0x10, 0x15, 0x16,
818
  0x1F, 0x1C, 0x19, 0x1A
819
];
820

821

822
/**
823
 * Precomputed lookup of multiplication by 9 in GF(2^8)
824
 * @type {!Array<number>}
825
 * @private
826
 */
827
goog.crypt.Aes.MULT_9_ = [
828
  0x00, 0x09, 0x12, 0x1B, 0x24, 0x2D, 0x36, 0x3F, 0x48, 0x41, 0x5A, 0x53,
829
  0x6C, 0x65, 0x7E, 0x77,
830

831
  0x90, 0x99, 0x82, 0x8B, 0xB4, 0xBD, 0xA6, 0xAF, 0xD8, 0xD1, 0xCA, 0xC3,
832
  0xFC, 0xF5, 0xEE, 0xE7,
833

834
  0x3B, 0x32, 0x29, 0x20, 0x1F, 0x16, 0x0D, 0x04, 0x73, 0x7A, 0x61, 0x68,
835
  0x57, 0x5E, 0x45, 0x4C,
836

837
  0xAB, 0xA2, 0xB9, 0xB0, 0x8F, 0x86, 0x9D, 0x94, 0xE3, 0xEA, 0xF1, 0xF8,
838
  0xC7, 0xCE, 0xD5, 0xDC,
839

840
  0x76, 0x7F, 0x64, 0x6D, 0x52, 0x5B, 0x40, 0x49, 0x3E, 0x37, 0x2C, 0x25,
841
  0x1A, 0x13, 0x08, 0x01,
842

843
  0xE6, 0xEF, 0xF4, 0xFD, 0xC2, 0xCB, 0xD0, 0xD9, 0xAE, 0xA7, 0xBC, 0xB5,
844
  0x8A, 0x83, 0x98, 0x91,
845

846
  0x4D, 0x44, 0x5F, 0x56, 0x69, 0x60, 0x7B, 0x72, 0x05, 0x0C, 0x17, 0x1E,
847
  0x21, 0x28, 0x33, 0x3A,
848

849
  0xDD, 0xD4, 0xCF, 0xC6, 0xF9, 0xF0, 0xEB, 0xE2, 0x95, 0x9C, 0x87, 0x8E,
850
  0xB1, 0xB8, 0xA3, 0xAA,
851

852
  0xEC, 0xE5, 0xFE, 0xF7, 0xC8, 0xC1, 0xDA, 0xD3, 0xA4, 0xAD, 0xB6, 0xBF,
853
  0x80, 0x89, 0x92, 0x9B,
854

855
  0x7C, 0x75, 0x6E, 0x67, 0x58, 0x51, 0x4A, 0x43, 0x34, 0x3D, 0x26, 0x2F,
856
  0x10, 0x19, 0x02, 0x0B,
857

858
  0xD7, 0xDE, 0xC5, 0xCC, 0xF3, 0xFA, 0xE1, 0xE8, 0x9F, 0x96, 0x8D, 0x84,
859
  0xBB, 0xB2, 0xA9, 0xA0,
860

861
  0x47, 0x4E, 0x55, 0x5C, 0x63, 0x6A, 0x71, 0x78, 0x0F, 0x06, 0x1D, 0x14,
862
  0x2B, 0x22, 0x39, 0x30,
863

864
  0x9A, 0x93, 0x88, 0x81, 0xBE, 0xB7, 0xAC, 0xA5, 0xD2, 0xDB, 0xC0, 0xC9,
865
  0xF6, 0xFF, 0xE4, 0xED,
866

867
  0x0A, 0x03, 0x18, 0x11, 0x2E, 0x27, 0x3C, 0x35, 0x42, 0x4B, 0x50, 0x59,
868
  0x66, 0x6F, 0x74, 0x7D,
869

870
  0xA1, 0xA8, 0xB3, 0xBA, 0x85, 0x8C, 0x97, 0x9E, 0xE9, 0xE0, 0xFB, 0xF2,
871
  0xCD, 0xC4, 0xDF, 0xD6,
872

873
  0x31, 0x38, 0x23, 0x2A, 0x15, 0x1C, 0x07, 0x0E, 0x79, 0x70, 0x6B, 0x62,
874
  0x5D, 0x54, 0x4F, 0x46
875
];
876

877

878
/**
879
 * Precomputed lookup of multiplication by 11 in GF(2^8)
880
 * @type {!Array<number>}
881
 * @private
882
 */
883
goog.crypt.Aes.MULT_B_ = [
884
  0x00, 0x0B, 0x16, 0x1D, 0x2C, 0x27, 0x3A, 0x31, 0x58, 0x53, 0x4E, 0x45,
885
  0x74, 0x7F, 0x62, 0x69,
886

887
  0xB0, 0xBB, 0xA6, 0xAD, 0x9C, 0x97, 0x8A, 0x81, 0xE8, 0xE3, 0xFE, 0xF5,
888
  0xC4, 0xCF, 0xD2, 0xD9,
889

890
  0x7B, 0x70, 0x6D, 0x66, 0x57, 0x5C, 0x41, 0x4A, 0x23, 0x28, 0x35, 0x3E,
891
  0x0F, 0x04, 0x19, 0x12,
892

893
  0xCB, 0xC0, 0xDD, 0xD6, 0xE7, 0xEC, 0xF1, 0xFA, 0x93, 0x98, 0x85, 0x8E,
894
  0xBF, 0xB4, 0xA9, 0xA2,
895

896
  0xF6, 0xFD, 0xE0, 0xEB, 0xDA, 0xD1, 0xCC, 0xC7, 0xAE, 0xA5, 0xB8, 0xB3,
897
  0x82, 0x89, 0x94, 0x9F,
898

899
  0x46, 0x4D, 0x50, 0x5B, 0x6A, 0x61, 0x7C, 0x77, 0x1E, 0x15, 0x08, 0x03,
900
  0x32, 0x39, 0x24, 0x2F,
901

902
  0x8D, 0x86, 0x9B, 0x90, 0xA1, 0xAA, 0xB7, 0xBC, 0xD5, 0xDE, 0xC3, 0xC8,
903
  0xF9, 0xF2, 0xEF, 0xE4,
904

905
  0x3D, 0x36, 0x2B, 0x20, 0x11, 0x1A, 0x07, 0x0C, 0x65, 0x6E, 0x73, 0x78,
906
  0x49, 0x42, 0x5F, 0x54,
907

908
  0xF7, 0xFC, 0xE1, 0xEA, 0xDB, 0xD0, 0xCD, 0xC6, 0xAF, 0xA4, 0xB9, 0xB2,
909
  0x83, 0x88, 0x95, 0x9E,
910

911
  0x47, 0x4C, 0x51, 0x5A, 0x6B, 0x60, 0x7D, 0x76, 0x1F, 0x14, 0x09, 0x02,
912
  0x33, 0x38, 0x25, 0x2E,
913

914
  0x8C, 0x87, 0x9A, 0x91, 0xA0, 0xAB, 0xB6, 0xBD, 0xD4, 0xDF, 0xC2, 0xC9,
915
  0xF8, 0xF3, 0xEE, 0xE5,
916

917
  0x3C, 0x37, 0x2A, 0x21, 0x10, 0x1B, 0x06, 0x0D, 0x64, 0x6F, 0x72, 0x79,
918
  0x48, 0x43, 0x5E, 0x55,
919

920
  0x01, 0x0A, 0x17, 0x1C, 0x2D, 0x26, 0x3B, 0x30, 0x59, 0x52, 0x4F, 0x44,
921
  0x75, 0x7E, 0x63, 0x68,
922

923
  0xB1, 0xBA, 0xA7, 0xAC, 0x9D, 0x96, 0x8B, 0x80, 0xE9, 0xE2, 0xFF, 0xF4,
924
  0xC5, 0xCE, 0xD3, 0xD8,
925

926
  0x7A, 0x71, 0x6C, 0x67, 0x56, 0x5D, 0x40, 0x4B, 0x22, 0x29, 0x34, 0x3F,
927
  0x0E, 0x05, 0x18, 0x13,
928

929
  0xCA, 0xC1, 0xDC, 0xD7, 0xE6, 0xED, 0xF0, 0xFB, 0x92, 0x99, 0x84, 0x8F,
930
  0xBE, 0xB5, 0xA8, 0xA3
931
];
932

933

934
/**
935
 * Precomputed lookup of multiplication by 13 in GF(2^8)
936
 * @type {!Array<number>}
937
 * @private
938
 */
939
goog.crypt.Aes.MULT_D_ = [
940
  0x00, 0x0D, 0x1A, 0x17, 0x34, 0x39, 0x2E, 0x23, 0x68, 0x65, 0x72, 0x7F,
941
  0x5C, 0x51, 0x46, 0x4B,
942

943
  0xD0, 0xDD, 0xCA, 0xC7, 0xE4, 0xE9, 0xFE, 0xF3, 0xB8, 0xB5, 0xA2, 0xAF,
944
  0x8C, 0x81, 0x96, 0x9B,
945

946
  0xBB, 0xB6, 0xA1, 0xAC, 0x8F, 0x82, 0x95, 0x98, 0xD3, 0xDE, 0xC9, 0xC4,
947
  0xE7, 0xEA, 0xFD, 0xF0,
948

949
  0x6B, 0x66, 0x71, 0x7C, 0x5F, 0x52, 0x45, 0x48, 0x03, 0x0E, 0x19, 0x14,
950
  0x37, 0x3A, 0x2D, 0x20,
951

952
  0x6D, 0x60, 0x77, 0x7A, 0x59, 0x54, 0x43, 0x4E, 0x05, 0x08, 0x1F, 0x12,
953
  0x31, 0x3C, 0x2B, 0x26,
954

955
  0xBD, 0xB0, 0xA7, 0xAA, 0x89, 0x84, 0x93, 0x9E, 0xD5, 0xD8, 0xCF, 0xC2,
956
  0xE1, 0xEC, 0xFB, 0xF6,
957

958
  0xD6, 0xDB, 0xCC, 0xC1, 0xE2, 0xEF, 0xF8, 0xF5, 0xBE, 0xB3, 0xA4, 0xA9,
959
  0x8A, 0x87, 0x90, 0x9D,
960

961
  0x06, 0x0B, 0x1C, 0x11, 0x32, 0x3F, 0x28, 0x25, 0x6E, 0x63, 0x74, 0x79,
962
  0x5A, 0x57, 0x40, 0x4D,
963

964
  0xDA, 0xD7, 0xC0, 0xCD, 0xEE, 0xE3, 0xF4, 0xF9, 0xB2, 0xBF, 0xA8, 0xA5,
965
  0x86, 0x8B, 0x9C, 0x91,
966

967
  0x0A, 0x07, 0x10, 0x1D, 0x3E, 0x33, 0x24, 0x29, 0x62, 0x6F, 0x78, 0x75,
968
  0x56, 0x5B, 0x4C, 0x41,
969

970
  0x61, 0x6C, 0x7B, 0x76, 0x55, 0x58, 0x4F, 0x42, 0x09, 0x04, 0x13, 0x1E,
971
  0x3D, 0x30, 0x27, 0x2A,
972

973
  0xB1, 0xBC, 0xAB, 0xA6, 0x85, 0x88, 0x9F, 0x92, 0xD9, 0xD4, 0xC3, 0xCE,
974
  0xED, 0xE0, 0xF7, 0xFA,
975

976
  0xB7, 0xBA, 0xAD, 0xA0, 0x83, 0x8E, 0x99, 0x94, 0xDF, 0xD2, 0xC5, 0xC8,
977
  0xEB, 0xE6, 0xF1, 0xFC,
978

979
  0x67, 0x6A, 0x7D, 0x70, 0x53, 0x5E, 0x49, 0x44, 0x0F, 0x02, 0x15, 0x18,
980
  0x3B, 0x36, 0x21, 0x2C,
981

982
  0x0C, 0x01, 0x16, 0x1B, 0x38, 0x35, 0x22, 0x2F, 0x64, 0x69, 0x7E, 0x73,
983
  0x50, 0x5D, 0x4A, 0x47,
984

985
  0xDC, 0xD1, 0xC6, 0xCB, 0xE8, 0xE5, 0xF2, 0xFF, 0xB4, 0xB9, 0xAE, 0xA3,
986
  0x80, 0x8D, 0x9A, 0x97
987
];
988

989

990
/**
991
 * Precomputed lookup of multiplication by 14 in GF(2^8)
992
 * @type {!Array<number>}
993
 * @private
994
 */
995
goog.crypt.Aes.MULT_E_ = [
996
  0x00, 0x0E, 0x1C, 0x12, 0x38, 0x36, 0x24, 0x2A, 0x70, 0x7E, 0x6C, 0x62,
997
  0x48, 0x46, 0x54, 0x5A,
998

999
  0xE0, 0xEE, 0xFC, 0xF2, 0xD8, 0xD6, 0xC4, 0xCA, 0x90, 0x9E, 0x8C, 0x82,
1000
  0xA8, 0xA6, 0xB4, 0xBA,
1001

1002
  0xDB, 0xD5, 0xC7, 0xC9, 0xE3, 0xED, 0xFF, 0xF1, 0xAB, 0xA5, 0xB7, 0xB9,
1003
  0x93, 0x9D, 0x8F, 0x81,
1004

1005
  0x3B, 0x35, 0x27, 0x29, 0x03, 0x0D, 0x1F, 0x11, 0x4B, 0x45, 0x57, 0x59,
1006
  0x73, 0x7D, 0x6F, 0x61,
1007

1008
  0xAD, 0xA3, 0xB1, 0xBF, 0x95, 0x9B, 0x89, 0x87, 0xDD, 0xD3, 0xC1, 0xCF,
1009
  0xE5, 0xEB, 0xF9, 0xF7,
1010

1011
  0x4D, 0x43, 0x51, 0x5F, 0x75, 0x7B, 0x69, 0x67, 0x3D, 0x33, 0x21, 0x2F,
1012
  0x05, 0x0B, 0x19, 0x17,
1013

1014
  0x76, 0x78, 0x6A, 0x64, 0x4E, 0x40, 0x52, 0x5C, 0x06, 0x08, 0x1A, 0x14,
1015
  0x3E, 0x30, 0x22, 0x2C,
1016

1017
  0x96, 0x98, 0x8A, 0x84, 0xAE, 0xA0, 0xB2, 0xBC, 0xE6, 0xE8, 0xFA, 0xF4,
1018
  0xDE, 0xD0, 0xC2, 0xCC,
1019

1020
  0x41, 0x4F, 0x5D, 0x53, 0x79, 0x77, 0x65, 0x6B, 0x31, 0x3F, 0x2D, 0x23,
1021
  0x09, 0x07, 0x15, 0x1B,
1022

1023
  0xA1, 0xAF, 0xBD, 0xB3, 0x99, 0x97, 0x85, 0x8B, 0xD1, 0xDF, 0xCD, 0xC3,
1024
  0xE9, 0xE7, 0xF5, 0xFB,
1025

1026
  0x9A, 0x94, 0x86, 0x88, 0xA2, 0xAC, 0xBE, 0xB0, 0xEA, 0xE4, 0xF6, 0xF8,
1027
  0xD2, 0xDC, 0xCE, 0xC0,
1028

1029
  0x7A, 0x74, 0x66, 0x68, 0x42, 0x4C, 0x5E, 0x50, 0x0A, 0x04, 0x16, 0x18,
1030
  0x32, 0x3C, 0x2E, 0x20,
1031

1032
  0xEC, 0xE2, 0xF0, 0xFE, 0xD4, 0xDA, 0xC8, 0xC6, 0x9C, 0x92, 0x80, 0x8E,
1033
  0xA4, 0xAA, 0xB8, 0xB6,
1034

1035
  0x0C, 0x02, 0x10, 0x1E, 0x34, 0x3A, 0x28, 0x26, 0x7C, 0x72, 0x60, 0x6E,
1036
  0x44, 0x4A, 0x58, 0x56,
1037

1038
  0x37, 0x39, 0x2B, 0x25, 0x0F, 0x01, 0x13, 0x1D, 0x47, 0x49, 0x5B, 0x55,
1039
  0x7F, 0x71, 0x63, 0x6D,
1040

1041
  0xD7, 0xD9, 0xCB, 0xC5, 0xEF, 0xE1, 0xF3, 0xFD, 0xA7, 0xA9, 0xBB, 0xB5,
1042
  0x9F, 0x91, 0x83, 0x8D
1043
];
1044
// clang-format on
1045

1046