READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

18,015 bytes · SHA-256 2f8a63e6a9a00da3… · View upstream ↗

1 /*********************************************************************
2 * Copyright (c) 2016 Pieter Wuille                                   *
3 * Distributed under the MIT software license, see the accompanying   *
4 * file COPYING or http://www.opensource.org/licenses/mit-license.php.*
5 **********************************************************************/
6
7/* Constant time, unoptimized, concise, plain C, AES implementation
8 * Based On:
9 *   Emilia Kasper and Peter Schwabe, Faster and Timing-Attack Resistant AES-GCM
10 *   http://www.iacr.org/archive/ches2009/57470001/57470001.pdf
11 * But using 8 16-bit integers representing a single AES state rather than 8 128-bit
12 * integers representing 8 AES states.
13 */
14
15#include "ctaes.h"
16
17/* Slice variable slice_i contains the i'th bit of the 16 state variables in this order:
18 *  0  1  2  3
19 *  4  5  6  7
20 *  8  9 10 11
21 * 12 13 14 15
22 */
23
24/** Convert a byte to sliced form, storing it corresponding to given row and column in s */
25static void LoadByte(AES_state* s, unsigned char byte, int r, int c) {
26    int i;
27    for (i = 0; i < 8; i++) {
28        s->slice[i] |= (byte & 1) << (r * 4 + c);
29        byte >>= 1;
30    }
31}
32
33/** Load 16 bytes of data into 8 sliced integers */
34static void LoadBytes(AES_state *s, const unsigned char* data16) {
35    int c;
36    for (c = 0; c < 4; c++) {
37        int r;
38        for (r = 0; r < 4; r++) {
39            LoadByte(s, *(data16++), r, c);
40        }
41    }
42}
43
44/** Convert 8 sliced integers into 16 bytes of data */
45static void SaveBytes(unsigned char* data16, const AES_state *s) {
46    int c;
47    for (c = 0; c < 4; c++) {
48        int r;
49        for (r = 0; r < 4; r++) {
50            int b;
51            uint8_t v = 0;
52            for (b = 0; b < 8; b++) {
53                v |= ((s->slice[b] >> (r * 4 + c)) & 1) << b;
54            }
55            *(data16++) = v;
56        }
57    }
58}
59
60/* S-box implementation based on the gate logic from:
61 *   Joan Boyar and Rene Peralta, A depth-16 circuit for the AES S-box.
62 *   https://eprint.iacr.org/2011/332.pdf
63*/
64static void SubBytes(AES_state *s, int inv) {
65    /* Load the bit slices */
66    uint16_t U0 = s->slice[7], U1 = s->slice[6], U2 = s->slice[5], U3 = s->slice[4];
67    uint16_t U4 = s->slice[3], U5 = s->slice[2], U6 = s->slice[1], U7 = s->slice[0];
68
69    uint16_t T1, T2, T3, T4, T5, T6, T7, T8, T9, T10, T11, T12, T13, T14, T15, T16;
70    uint16_t T17, T18, T19, T20, T21, T22, T23, T24, T25, T26, T27, D;
71    uint16_t M1, M6, M11, M13, M15, M20, M21, M22, M23, M25, M37, M38, M39, M40;
72    uint16_t M41, M42, M43, M44, M45, M46, M47, M48, M49, M50, M51, M52, M53, M54;
73    uint16_t M55, M56, M57, M58, M59, M60, M61, M62, M63;
74
75    if (inv) {
76        uint16_t R5, R13, R17, R18, R19;
77        /* Undo linear postprocessing */
78        T23 = U0 ^ U3;
79        T22 = ~(U1 ^ U3);
80        T2 = ~(U0 ^ U1);
81        T1 = U3 ^ U4;
82        T24 = ~(U4 ^ U7);
83        R5 = U6 ^ U7;
84        T8 = ~(U1 ^ T23);
85        T19 = T22 ^ R5;
86        T9 = ~(U7 ^ T1);
87        T10 = T2 ^ T24;
88        T13 = T2 ^ R5;
89        T3 = T1 ^ R5;
90        T25 = ~(U2 ^ T1);
91        R13 = U1 ^ U6;
92        T17 = ~(U2 ^ T19);
93        T20 = T24 ^ R13;
94        T4 = U4 ^ T8;
95        R17 = ~(U2 ^ U5);
96        R18 = ~(U5 ^ U6);
97        R19 = ~(U2 ^ U4);
98        D = U0 ^ R17;
99        T6 = T22 ^ R17;
100        T16 = R13 ^ R19;
101        T27 = T1 ^ R18;
102        T15 = T10 ^ T27;
103        T14 = T10 ^ R18;
104        T26 = T3 ^ T16;
105    } else {
106        /* Linear preprocessing. */
107        T1 = U0 ^ U3;
108        T2 = U0 ^ U5;
109        T3 = U0 ^ U6;
110        T4 = U3 ^ U5;
111        T5 = U4 ^ U6;
112        T6 = T1 ^ T5;
113        T7 = U1 ^ U2;
114        T8 = U7 ^ T6;
115        T9 = U7 ^ T7;
116        T10 = T6 ^ T7;
117        T11 = U1 ^ U5;
118        T12 = U2 ^ U5;
119        T13 = T3 ^ T4;
120        T14 = T6 ^ T11;
121        T15 = T5 ^ T11;
122        T16 = T5 ^ T12;
123        T17 = T9 ^ T16;
124        T18 = U3 ^ U7;
125        T19 = T7 ^ T18;
126        T20 = T1 ^ T19;
127        T21 = U6 ^ U7;
128        T22 = T7 ^ T21;
129        T23 = T2 ^ T22;
130        T24 = T2 ^ T10;
131        T25 = T20 ^ T17;
132        T26 = T3 ^ T16;
133        T27 = T1 ^ T12;
134        D = U7;
135    }
136
137    /* Non-linear transformation (shared between the forward and backward case) */
138    M1 = T13 & T6;
139    M6 = T3 & T16;
140    M11 = T1 & T15;
141    M13 = (T4 & T27) ^ M11;
142    M15 = (T2 & T10) ^ M11;
143    M20 = T14 ^ M1 ^ (T23 & T8) ^ M13;
144    M21 = (T19 & D) ^ M1 ^ T24 ^ M15;
145    M22 = T26 ^ M6 ^ (T22 & T9) ^ M13;
146    M23 = (T20 & T17) ^ M6 ^ M15 ^ T25;
147    M25 = M22 & M20;
148    M37 = M21 ^ ((M20 ^ M21) & (M23 ^ M25));
149    M38 = M20 ^ M25 ^ (M21 | (M20 & M23));
150    M39 = M23 ^ ((M22 ^ M23) & (M21 ^ M25));
151    M40 = M22 ^ M25 ^ (M23 | (M21 & M22));
152    M41 = M38 ^ M40;
153    M42 = M37 ^ M39;
154    M43 = M37 ^ M38;
155    M44 = M39 ^ M40;
156    M45 = M42 ^ M41;
157    M46 = M44 & T6;
158    M47 = M40 & T8;
159    M48 = M39 & D;
160    M49 = M43 & T16;
161    M50 = M38 & T9;
162    M51 = M37 & T17;
163    M52 = M42 & T15;
164    M53 = M45 & T27;
165    M54 = M41 & T10;
166    M55 = M44 & T13;
167    M56 = M40 & T23;
168    M57 = M39 & T19;
169    M58 = M43 & T3;
170    M59 = M38 & T22;
171    M60 = M37 & T20;
172    M61 = M42 & T1;
173    M62 = M45 & T4;
174    M63 = M41 & T2;
175
176    if (inv){
177        /* Undo linear preprocessing */
178        uint16_t P0 = M52 ^ M61;
179        uint16_t P1 = M58 ^ M59;
180        uint16_t P2 = M54 ^ M62;
181        uint16_t P3 = M47 ^ M50;
182        uint16_t P4 = M48 ^ M56;
183        uint16_t P5 = M46 ^ M51;
184        uint16_t P6 = M49 ^ M60;
185        uint16_t P7 = P0 ^ P1;
186        uint16_t P8 = M50 ^ M53;
187        uint16_t P9 = M55 ^ M63;
188        uint16_t P10 = M57 ^ P4;
189        uint16_t P11 = P0 ^ P3;
190        uint16_t P12 = M46 ^ M48;
191        uint16_t P13 = M49 ^ M51;
192        uint16_t P14 = M49 ^ M62;
193        uint16_t P15 = M54 ^ M59;
194        uint16_t P16 = M57 ^ M61;
195        uint16_t P17 = M58 ^ P2;
196        uint16_t P18 = M63 ^ P5;
197        uint16_t P19 = P2 ^ P3;
198        uint16_t P20 = P4 ^ P6;
199        uint16_t P22 = P2 ^ P7;
200        uint16_t P23 = P7 ^ P8;
201        uint16_t P24 = P5 ^ P7;
202        uint16_t P25 = P6 ^ P10;
203        uint16_t P26 = P9 ^ P11;
204        uint16_t P27 = P10 ^ P18;
205        uint16_t P28 = P11 ^ P25;
206        uint16_t P29 = P15 ^ P20;
207        s->slice[7] = P13 ^ P22;
208        s->slice[6] = P26 ^ P29;
209        s->slice[5] = P17 ^ P28;
210        s->slice[4] = P12 ^ P22;
211        s->slice[3] = P23 ^ P27;
212        s->slice[2] = P19 ^ P24;
213        s->slice[1] = P14 ^ P23;
214        s->slice[0] = P9 ^ P16;
215    } else {
216        /* Linear postprocessing */
217        uint16_t L0 = M61 ^ M62;
218        uint16_t L1 = M50 ^ M56;
219        uint16_t L2 = M46 ^ M48;
220        uint16_t L3 = M47 ^ M55;
221        uint16_t L4 = M54 ^ M58;
222        uint16_t L5 = M49 ^ M61;
223        uint16_t L6 = M62 ^ L5;
224        uint16_t L7 = M46 ^ L3;
225        uint16_t L8 = M51 ^ M59;
226        uint16_t L9 = M52 ^ M53;
227        uint16_t L10 = M53 ^ L4;
228        uint16_t L11 = M60 ^ L2;
229        uint16_t L12 = M48 ^ M51;
230        uint16_t L13 = M50 ^ L0;
231        uint16_t L14 = M52 ^ M61;
232        uint16_t L15 = M55 ^ L1;
233        uint16_t L16 = M56 ^ L0;
234        uint16_t L17 = M57 ^ L1;
235        uint16_t L18 = M58 ^ L8;
236        uint16_t L19 = M63 ^ L4;
237        uint16_t L20 = L0 ^ L1;
238        uint16_t L21 = L1 ^ L7;
239        uint16_t L22 = L3 ^ L12;
240        uint16_t L23 = L18 ^ L2;
241        uint16_t L24 = L15 ^ L9;
242        uint16_t L25 = L6 ^ L10;
243        uint16_t L26 = L7 ^ L9;
244        uint16_t L27 = L8 ^ L10;
245        uint16_t L28 = L11 ^ L14;
246        uint16_t L29 = L11 ^ L17;
247        s->slice[7] = L6 ^ L24;
248        s->slice[6] = ~(L16 ^ L26);
249        s->slice[5] = ~(L19 ^ L28);
250        s->slice[4] = L6 ^ L21;

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.