Merge branch 'otp' into working

Change-Id: Ieeaae330e8330189e87ee6726848178d0b9934e7

4 files changed, 935 insertions, 20 deletions

diff --git a/apps/plugins/lib/SOURCES b/apps/plugins/lib/SOURCES
index 747355b..ee6f2fc 100644
--- a/apps/plugins/lib/SOURCES
+++ b/apps/plugins/lib/SOURCES
@@ -1,3 +1,4 @@
+aes.c
 sha1.c
 gcc-support.c
 pluginlib_actions.c
diff --git a/apps/plugins/lib/aes.c b/apps/plugins/lib/aes.c
new file mode 100644
index 0000000..837ce91
--- /dev/null
+++ b/apps/plugins/lib/aes.c
@@ -0,0 +1,612 @@
+// This following AES implementation is from tiny-AES128-c.
+
+/*
+ * This is free and unencumbered software released into the public domain.
+ *
+ * Anyone is free to copy, modify, publish, use, compile, sell, or
+ * distribute this software, either in source code form or as a compiled
+ * binary, for any purpose, commercial or non-commercial, and by any
+ * means.
+ *
+ * In jurisdictions that recognize copyright laws, the author or authors
+ * of this software dedicate any and all copyright interest in the
+ * software to the public domain. We make this dedication for the benefit
+ * of the public at large and to the detriment of our heirs and
+ * successors. We intend this dedication to be an overt act of
+ * relinquishment in perpetuity of all present and future rights to this
+ * software under copyright law.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * For more information, please refer to <http://unlicense.org/>
+ */
+
+#include "aes.h"
+
+/*
+
+This is an implementation of the AES128 algorithm, specifically ECB and CBC mode.
+
+The implementation is verified against the test vectors in:
+  National Institute of Standards and Technology Special Publication 800-38A 2001 ED
+
+ECB-AES128
+----------
+
+  plain-text:
+    6bc1bee22e409f96e93d7e117393172a
+    ae2d8a571e03ac9c9eb76fac45af8e51
+    30c81c46a35ce411e5fbc1191a0a52ef
+    f69f2445df4f9b17ad2b417be66c3710
+
+  key:
+    2b7e151628aed2a6abf7158809cf4f3c
+
+  resulting cipher
+    3ad77bb40d7a3660a89ecaf32466ef97
+    f5d3d58503b9699de785895a96fdbaaf
+    43b1cd7f598ece23881b00e3ed030688
+    7b0c785e27e8ad3f8223207104725dd4
+
+
+NOTE:   String length must be evenly divisible by 16byte (str_len % 16 == 0)
+        You should pad the end of the string with zeros if this is not the case.
+
+*/
+
+
+/*****************************************************************************/
+/* Includes:                                                                 */
+/*****************************************************************************/
+#include <stdint.h>
+#include <string.h> // CBC mode, for memset
+#include "aes.h"
+
+
+/*****************************************************************************/
+/* Defines:                                                                  */
+/*****************************************************************************/
+// The number of columns comprising a state in AES. This is a constant in AES. Value=4
+#define Nb 4
+// The number of 32 bit words in a key.
+#define Nk 4
+// Key length in bytes [128 bit]
+#define KEYLEN 16
+// The number of rounds in AES Cipher.
+#define Nr 10
+
+// jcallan@github points out that declaring Multiply as a function
+// reduces code size considerably with the Keil ARM compiler.
+// See this link for more information: https://github.com/kokke/tiny-AES128-C/pull/3
+#ifndef MULTIPLY_AS_A_FUNCTION
+  #define MULTIPLY_AS_A_FUNCTION 0
+#endif
+
+
+/*****************************************************************************/
+/* Private variables:                                                        */
+/*****************************************************************************/
+// state - array holding the intermediate results during decryption.
+typedef uint8_t state_t[4][4];
+static state_t* state;
+
+// The array that stores the round keys.
+static uint8_t RoundKey[176];
+
+// The Key input to the AES Program
+static const uint8_t* Key;
+
+#if defined(CBC) && CBC
+  // Initial Vector used only for CBC mode
+  static uint8_t* Iv;
+#endif
+
+// The lookup-tables are marked const so they can be placed in read-only storage instead of RAM
+// The numbers below can be computed dynamically trading ROM for RAM -
+// This can be useful in (embedded) bootloader applications, where ROM is often limited.
+static const uint8_t sbox[256] =   {
+  //0     1    2      3     4    5     6     7      8    9     A      B    C     D     E     F
+  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 };
+
+static const uint8_t rsbox[256] =
+{ 0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
+  0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
+  0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
+  0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
+  0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
+  0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
+  0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
+  0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
+  0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
+  0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
+  0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
+  0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
+  0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
+  0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
+  0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
+  0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d };
+
+
+// The round constant word array, Rcon[i], contains the values given by
+// x to th e power (i-1) being powers of x (x is denoted as {02}) in the field GF(2^8)
+// Note that i starts at 1, not 0).
+static const uint8_t Rcon[255] = {
+  0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,
+  0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39,
+  0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a,
+  0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8,
+  0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,
+  0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc,
+  0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b,
+  0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3,
+  0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,
+  0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20,
+  0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35,
+  0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f,
+  0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb, 0x8d, 0x01, 0x02, 0x04,
+  0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a, 0x2f, 0x5e, 0xbc, 0x63,
+  0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef, 0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd,
+  0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94, 0x33, 0x66, 0xcc, 0x83, 0x1d, 0x3a, 0x74, 0xe8, 0xcb  };
+
+
+/*****************************************************************************/
+/* Private functions:                                                        */
+/*****************************************************************************/
+static uint8_t getSBoxValue(uint8_t num)
+{
+  return sbox[num];
+}
+
+static uint8_t getSBoxInvert(uint8_t num)
+{
+  return rsbox[num];
+}
+
+// This function produces Nb(Nr+1) round keys. The round keys are used in each round to decrypt the states.
+static void KeyExpansion(void)
+{
+  uint32_t i, j, k;
+  uint8_t tempa[4]; // Used for the column/row operations
+
+  // The first round key is the key itself.
+  for(i = 0; i < Nk; ++i)
+  {
+    RoundKey[(i * 4) + 0] = Key[(i * 4) + 0];
+    RoundKey[(i * 4) + 1] = Key[(i * 4) + 1];
+    RoundKey[(i * 4) + 2] = Key[(i * 4) + 2];
+    RoundKey[(i * 4) + 3] = Key[(i * 4) + 3];
+  }
+
+  // All other round keys are found from the previous round keys.
+  for(; (i < (Nb * (Nr + 1))); ++i)
+  {
+    for(j = 0; j < 4; ++j)
+    {
+      tempa[j]=RoundKey[(i-1) * 4 + j];
+    }
+    if (i % Nk == 0)
+    {
+      // This function rotates the 4 bytes in a word to the left once.
+      // [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
+
+      // Function RotWord()
+      {
+        k = tempa[0];
+        tempa[0] = tempa[1];
+        tempa[1] = tempa[2];
+        tempa[2] = tempa[3];
+        tempa[3] = k;
+      }
+
+      // SubWord() is a function that takes a four-byte input word and
+      // applies the S-box to each of the four bytes to produce an output word.
+
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+
+      tempa[0] =  tempa[0] ^ Rcon[i/Nk];
+    }
+    else if (Nk > 6 && i % Nk == 4)
+    {
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+    }
+    RoundKey[i * 4 + 0] = RoundKey[(i - Nk) * 4 + 0] ^ tempa[0];
+    RoundKey[i * 4 + 1] = RoundKey[(i - Nk) * 4 + 1] ^ tempa[1];
+    RoundKey[i * 4 + 2] = RoundKey[(i - Nk) * 4 + 2] ^ tempa[2];
+    RoundKey[i * 4 + 3] = RoundKey[(i - Nk) * 4 + 3] ^ tempa[3];
+  }
+}
+
+// This function adds the round key to state.
+// The round key is added to the state by an XOR function.
+static void AddRoundKey(uint8_t round)
+{
+  uint8_t i,j;
+  for(i=0;i<4;++i)
+  {
+    for(j = 0; j < 4; ++j)
+    {
+      (*state)[i][j] ^= RoundKey[round * Nb * 4 + i * Nb + j];
+    }
+  }
+}
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void SubBytes(void)
+{
+  uint8_t i, j;
+  for(i = 0; i < 4; ++i)
+  {
+    for(j = 0; j < 4; ++j)
+    {
+      (*state)[j][i] = getSBoxValue((*state)[j][i]);
+    }
+  }
+}
+
+// The ShiftRows() function shifts the rows in the state to the left.
+// Each row is shifted with different offset.
+// Offset = Row number. So the first row is not shifted.
+static void ShiftRows(void)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to left
+  temp           = (*state)[0][1];
+  (*state)[0][1] = (*state)[1][1];
+  (*state)[1][1] = (*state)[2][1];
+  (*state)[2][1] = (*state)[3][1];
+  (*state)[3][1] = temp;
+
+  // Rotate second row 2 columns to left
+  temp           = (*state)[0][2];
+  (*state)[0][2] = (*state)[2][2];
+  (*state)[2][2] = temp;
+
+  temp       = (*state)[1][2];
+  (*state)[1][2] = (*state)[3][2];
+  (*state)[3][2] = temp;
+
+  // Rotate third row 3 columns to left
+  temp       = (*state)[0][3];
+  (*state)[0][3] = (*state)[3][3];
+  (*state)[3][3] = (*state)[2][3];
+  (*state)[2][3] = (*state)[1][3];
+  (*state)[1][3] = temp;
+}
+
+static uint8_t xtime(uint8_t x)
+{
+  return ((x<<1) ^ (((x>>7) & 1) * 0x1b));
+}
+
+// MixColumns function mixes the columns of the state matrix
+static void MixColumns(void)
+{
+  uint8_t i;
+  uint8_t Tmp,Tm,t;
+  for(i = 0; i < 4; ++i)
+  {
+    t   = (*state)[i][0];
+    Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3] ;
+    Tm  = (*state)[i][0] ^ (*state)[i][1] ; Tm = xtime(Tm);  (*state)[i][0] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][1] ^ (*state)[i][2] ; Tm = xtime(Tm);  (*state)[i][1] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][2] ^ (*state)[i][3] ; Tm = xtime(Tm);  (*state)[i][2] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][3] ^ t ;        Tm = xtime(Tm);  (*state)[i][3] ^= Tm ^ Tmp ;
+  }
+}
+
+// Multiply is used to multiply numbers in the field GF(2^8)
+#if MULTIPLY_AS_A_FUNCTION
+static uint8_t Multiply(uint8_t x, uint8_t y)
+{
+  return (((y & 1) * x) ^
+       ((y>>1 & 1) * xtime(x)) ^
+       ((y>>2 & 1) * xtime(xtime(x))) ^
+       ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^
+       ((y>>4 & 1) * xtime(xtime(xtime(xtime(x))))));
+  }
+#else
+#define Multiply(x, y)                                \
+      (  ((y & 1) * x) ^                              \
+      ((y>>1 & 1) * xtime(x)) ^                       \
+      ((y>>2 & 1) * xtime(xtime(x))) ^                \
+      ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^         \
+      ((y>>4 & 1) * xtime(xtime(xtime(xtime(x))))))   \
+
+#endif
+
+// MixColumns function mixes the columns of the state matrix.
+// The method used to multiply may be difficult to understand for the inexperienced.
+// Please use the references to gain more information.
+static void InvMixColumns(void)
+{
+  int i;
+  uint8_t a,b,c,d;
+  for(i=0;i<4;++i)
+  {
+    a = (*state)[i][0];
+    b = (*state)[i][1];
+    c = (*state)[i][2];
+    d = (*state)[i][3];
+
+    (*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
+    (*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
+    (*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
+    (*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
+  }
+}
+
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void InvSubBytes(void)
+{
+  uint8_t i,j;
+  for(i=0;i<4;++i)
+  {
+    for(j=0;j<4;++j)
+    {
+      (*state)[j][i] = getSBoxInvert((*state)[j][i]);
+    }
+  }
+}
+
+static void InvShiftRows(void)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to right
+  temp=(*state)[3][1];
+  (*state)[3][1]=(*state)[2][1];
+  (*state)[2][1]=(*state)[1][1];
+  (*state)[1][1]=(*state)[0][1];
+  (*state)[0][1]=temp;
+
+  // Rotate second row 2 columns to right
+  temp=(*state)[0][2];
+  (*state)[0][2]=(*state)[2][2];
+  (*state)[2][2]=temp;
+
+  temp=(*state)[1][2];
+  (*state)[1][2]=(*state)[3][2];
+  (*state)[3][2]=temp;
+
+  // Rotate third row 3 columns to right
+  temp=(*state)[0][3];
+  (*state)[0][3]=(*state)[1][3];
+  (*state)[1][3]=(*state)[2][3];
+  (*state)[2][3]=(*state)[3][3];
+  (*state)[3][3]=temp;
+}
+
+
+// Cipher is the main function that encrypts the PlainText.
+static void Cipher(void)
+{
+  uint8_t round = 0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(0);
+
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr-1 rounds are executed in the loop below.
+  for(round = 1; round < Nr; ++round)
+  {
+    SubBytes();
+    ShiftRows();
+    MixColumns();
+    AddRoundKey(round);
+  }
+
+  // The last round is given below.
+  // The MixColumns function is not here in the last round.
+  SubBytes();
+  ShiftRows();
+  AddRoundKey(Nr);
+}
+
+static void InvCipher(void)
+{
+  uint8_t round=0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(Nr);
+
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr-1 rounds are executed in the loop below.
+  for(round=Nr-1;round>0;round--)
+  {
+    InvShiftRows();
+    InvSubBytes();
+    AddRoundKey(round);
+    InvMixColumns();
+  }
+
+  // The last round is given below.
+  // The MixColumns function is not here in the last round.
+  InvShiftRows();
+  InvSubBytes();
+  AddRoundKey(0);
+}
+
+static void BlockCopy(uint8_t* output, uint8_t* input)
+{
+  uint8_t i;
+  for (i=0;i<KEYLEN;++i)
+  {
+    output[i] = input[i];
+  }
+}
+
+
+
+/*****************************************************************************/
+/* Public functions:                                                         */
+/*****************************************************************************/
+#if defined(ECB) && ECB
+
+
+void AES128_ECB_encrypt(uint8_t* input, const uint8_t* key, uint8_t* output)
+{
+  // Copy input to output, and work in-memory on output
+  BlockCopy(output, input);
+  state = (state_t*)output;
+
+  Key = key;
+  KeyExpansion();
+
+  // The next function call encrypts the PlainText with the Key using AES algorithm.
+  Cipher();
+}
+
+void AES128_ECB_decrypt(uint8_t* input, const uint8_t* key, uint8_t *output)
+{
+  // Copy input to output, and work in-memory on output
+  BlockCopy(output, input);
+  state = (state_t*)output;
+
+  // The KeyExpansion routine must be called before encryption.
+  Key = key;
+  KeyExpansion();
+
+  InvCipher();
+}
+
+
+#endif // #if defined(ECB) && ECB
+
+
+
+
+
+#if defined(CBC) && CBC
+
+
+static void XorWithIv(uint8_t* buf)
+{
+  uint8_t i;
+  for(i = 0; i < KEYLEN; ++i)
+  {
+    buf[i] ^= Iv[i];
+  }
+}
+
+void AES128_CBC_encrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, const uint8_t* key, const uint8_t* iv)
+{
+  uintptr_t i;
+  uint8_t remainders = length % KEYLEN; /* Remaining bytes in the last non-full block */
+
+  BlockCopy(output, input);
+  state = (state_t*)output;
+
+  // Skip the key expansion if key is passed as 0
+  if(0 != key)
+  {
+    Key = key;
+    KeyExpansion();
+  }
+
+  if(iv != 0)
+  {
+    Iv = (uint8_t*)iv;
+  }
+
+  for(i = 0; i < length; i += KEYLEN)
+  {
+    XorWithIv(input);
+    BlockCopy(output, input);
+    state = (state_t*)output;
+    Cipher();
+    Iv = output;
+    input += KEYLEN;
+    output += KEYLEN;
+  }
+
+  if(remainders)
+  {
+    BlockCopy(output, input);
+    memset(output + remainders, 0, KEYLEN - remainders); /* add 0-padding */
+    state = (state_t*)output;
+    Cipher();
+  }
+}
+
+void AES128_CBC_decrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, const uint8_t* key, const uint8_t* iv)
+{
+  uintptr_t i;
+  uint8_t remainders = length % KEYLEN; /* Remaining bytes in the last non-full block */
+
+  BlockCopy(output, input);
+  state = (state_t*)output;
+
+  // Skip the key expansion if key is passed as 0
+  if(0 != key)
+  {
+    Key = key;
+    KeyExpansion();
+  }
+
+  // If iv is passed as 0, we continue to encrypt without re-setting the Iv
+  if(iv != 0)
+  {
+    Iv = (uint8_t*)iv;
+  }
+
+  for(i = 0; i < length; i += KEYLEN)
+  {
+    BlockCopy(output, input);
+    state = (state_t*)output;
+    InvCipher();
+    XorWithIv(output);
+    Iv = input;
+    input += KEYLEN;
+    output += KEYLEN;
+  }
+
+  if(remainders)
+  {
+    BlockCopy(output, input);
+    memset(output+remainders, 0, KEYLEN - remainders); /* add 0-padding */
+    state = (state_t*)output;
+    InvCipher();
+  }
+}
+
+
+#endif // #if defined(CBC) && CBC
diff --git a/apps/plugins/lib/aes.h b/apps/plugins/lib/aes.h
new file mode 100644
index 0000000..ae20f69
--- /dev/null
+++ b/apps/plugins/lib/aes.h
@@ -0,0 +1,68 @@
+// This following AES implementation is from tiny-AES128-c.
+
+/*
+ * This is free and unencumbered software released into the public domain.
+ *
+ * Anyone is free to copy, modify, publish, use, compile, sell, or
+ * distribute this software, either in source code form or as a compiled
+ * binary, for any purpose, commercial or non-commercial, and by any
+ * means.
+ *
+ * In jurisdictions that recognize copyright laws, the author or authors
+ * of this software dedicate any and all copyright interest in the
+ * software to the public domain. We make this dedication for the benefit
+ * of the public at large and to the detriment of our heirs and
+ * successors. We intend this dedication to be an overt act of
+ * relinquishment in perpetuity of all present and future rights to this
+ * software under copyright law.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+ * EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+ * MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+ * IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR ANY CLAIM, DAMAGES OR
+ * OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE,
+ * ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
+ * OTHER DEALINGS IN THE SOFTWARE.
+ *
+ * For more information, please refer to <http://unlicense.org/>
+ */
+
+#ifndef _AES_H_
+#define _AES_H_
+
+#include "plugin.h"
+
+// #define the macros below to 1/0 to enable/disable the mode of operation.
+//
+// CBC enables AES128 encryption in CBC-mode of operation and handles 0-padding.
+// ECB enables the basic ECB 16-byte block algorithm. Both can be enabled simultaneously.
+
+// The #ifndef-guard allows it to be configured before #include'ing or at compile time.
+#ifndef CBC
+  #define CBC 1
+#endif
+
+#ifndef ECB
+  #define ECB 1
+#endif
+
+
+
+#if defined(ECB) && ECB
+
+void AES128_ECB_encrypt(uint8_t* input, const uint8_t* key, uint8_t *output);
+void AES128_ECB_decrypt(uint8_t* input, const uint8_t* key, uint8_t *output);
+
+#endif // #if defined(ECB) && ECB
+
+
+#if defined(CBC) && CBC
+
+void AES128_CBC_encrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, const uint8_t* key, const uint8_t* iv);
+void AES128_CBC_decrypt_buffer(uint8_t* output, uint8_t* input, uint32_t length, const uint8_t* key, const uint8_t* iv);
+
+#endif // #if defined(CBC) && CBC
+
+
+
+#endif //_AES_H_
diff --git a/apps/plugins/otp.c b/apps/plugins/otp.c
index aabd703..8520fb8 100644
--- a/apps/plugins/otp.c
+++ b/apps/plugins/otp.c
@@ -25,15 +25,18 @@
 
 #include "plugin.h"
 
+#include "lib/aes.h"
 #include "lib/display_text.h"
 #include "lib/pluginlib_actions.h"
 #include "lib/pluginlib_exit.h"
 #include "lib/sha1.h"
 
+/* don't change these if you want to maintain backwards compatibility */
 #define MAX_NAME   50
-#define SECRET_MAX 64 /* enough for a 512-bit secret */
+#define SECRET_MAX 256
 #define URI_MAX    256
 #define ACCT_FILE  PLUGIN_APPS_DATA_DIR "/otp.dat"
+#define PASS_MAX 32
 
 #define MAX(a, b) (((a)>(b))?(a):(b))
 
@@ -63,6 +66,10 @@ static int next_slot = 0;
 /* in SECONDS, asked for on first run */
 static int time_offs = 0;
 
+static bool encrypted = false;
+
+static char enc_password[PASS_MAX + 1];
+
 static void acct_menu(const char *title, void (*cb)(int acct));
 
 static int HOTP(unsigned char *secret, size_t sec_len, uint64_t ctr, int digits)
@@ -224,6 +231,49 @@ static bool browse( char *dst, int dst_size, const char *start )
     return (browse.flags & BROWSE_SELECTED);
 }
 
+struct aes_ctr_ctx {
+    char key[16];
+    union {
+        char bytes[16];
+        uint64_t half[2];
+    } counter;
+    /* one block */
+    char keystream[16];
+    uint8_t bytes_left;
+};
+
+static void aes_ctr_init(struct aes_ctr_ctx *ctx, const char *key, uint64_t nonce)
+{
+    rb->memcpy(ctx->key, key, 16);
+    ctx->counter.half[0] = nonce;
+    ctx->counter.half[1] = 0;
+    ctx->bytes_left = 0;
+}
+
+static void aes_ctr_nextblock(struct aes_ctr_ctx *ctx)
+{
+    AES128_ECB_encrypt((char*)&ctx->counter, ctx->key, ctx->keystream);
+    ctx->counter.half[1]++;
+    ctx->bytes_left = 16;
+}
+
+static void aes_ctr_process(struct aes_ctr_ctx *ctx, const char *in, char *out, size_t len)
+{
+    while(len--)
+    {
+        if(!ctx->bytes_left)
+            aes_ctr_nextblock(ctx);
+        *out++ = *in++ ^ ctx->keystream[16 - ctx->bytes_left--];
+    }
+}
+
+static void aes_ctr_destroy(struct aes_ctr_ctx *ctx)
+{
+    rb->memset(ctx, 0, sizeof(ctx));
+    rb->memset(ctx, 0xff, sizeof(ctx));
+    rb->memset(ctx, 0, sizeof(ctx));
+}
+
 static bool read_accts(void)
 {
     int fd = rb->open(ACCT_FILE, O_RDONLY);
@@ -231,9 +281,11 @@ static bool read_accts(void)
         return false;
 
     char buf[4];
-    char magic[4] = { 'O', 'T', 'P', '1' };
+    /* two versions to maintain backwards-compatibility */
+    char magic_old[] = "OTP1";
+    char magic[] = "OTP2";
     rb->read(fd, buf, 4);
-    if(memcmp(magic, buf, 4))
+    if(rb->memcmp(magic, buf, 4) && rb->memcmp(magic_old, buf, 4))
     {
         rb->splash(HZ * 2, "Corrupt save data!");
         rb->close(fd);
@@ -242,6 +294,71 @@ static bool read_accts(void)
 
     rb->read(fd, &time_offs, sizeof(time_offs));
 
+    if(!rb->memcmp(magic, buf, 4))
+    {
+        /* version 2 */
+        rb->read(fd, &encrypted, sizeof(encrypted));
+        if(encrypted)
+        {
+            uint64_t nonce;
+            rb->read(fd, &nonce, sizeof(nonce));
+
+            char in[sizeof(struct account_t)];
+            char buf[4] = {0};
+            char magic[] = "OTP2";
+
+            /* read the encrypted header */
+            rb->read(fd, in, 4);
+
+            for(int i = 0; i < 3; ++i)
+            {
+                rb->splash(HZ * 2, "Enter password:");
+                enc_password[0] = '\0';
+                if(rb->kbd_input(enc_password, sizeof(enc_password)) < 0)
+                {
+                    rb->close(fd);
+                    exit(PLUGIN_ERROR);
+                }
+
+                /* decrypt the data with AES128-CTR */
+                /* the HMAC-SHA-1 of the password and nonce are truncated to form the key */
+                char key[20];
+
+                hmac_sha1(&nonce, sizeof(nonce), enc_password, rb->strlen(enc_password), key);
+
+                struct aes_ctr_ctx aes_ctx;
+
+                aes_ctr_init(&aes_ctx, key, nonce);
+
+                aes_ctr_process(&aes_ctx, in, buf, 4);
+                if(rb->memcmp(buf, magic, 4))
+                {
+                    rb->splashf(HZ * 4, "Wrong password!");
+                    continue;
+                }
+
+                while(next_slot < max_accts)
+                {
+                    if(rb->read(fd, in, sizeof(in)) != sizeof(struct account_t))
+                        break;
+                    aes_ctr_process(&aes_ctx, in, (char*)accounts + next_slot, sizeof(struct account_t));
+                    ++next_slot;
+                }
+
+                aes_ctr_destroy(&aes_ctx);
+
+                rb->close(fd);
+
+                return true;
+            }
+
+            /* failure */
+            rb->close(fd);
+
+            exit(PLUGIN_ERROR);
+        }
+    }
+
     while(next_slot < max_accts)
     {
         if(rb->read(fd, accounts + next_slot, sizeof(struct account_t)) != sizeof(struct account_t))
@@ -256,12 +373,51 @@ static bool read_accts(void)
 static void save_accts(void)
 {
     int fd = rb->open(ACCT_FILE, O_WRONLY | O_CREAT | O_TRUNC, 0600);
-    rb->fdprintf(fd, "OTP1");
+
+    rb->fdprintf(fd, "OTP2");
 
     rb->write(fd, &time_offs, sizeof(time_offs));
+    rb->write(fd, &encrypted, sizeof(encrypted));
+
+    if(encrypted)
+    {
+        /* encrypt the data with AES128-CTR */
+
+        /* generate/write the nonce */
+        //uint64_t nonce = *rb->current_tick;
+#if CONFIG_RTC
+        //nonce += get_utc();
+#endif
+        uint64_t nonce = 42;
+
+        rb->write(fd, &nonce, sizeof(nonce));
+
+        /* the SHA-1 of the password is truncated to 128 bits to form the key */
+        char key[20];
+
+        hmac_sha1(&nonce, sizeof(nonce), enc_password, rb->strlen(enc_password), key);
+
+        struct aes_ctr_ctx aes_ctx;
+        aes_ctr_init(&aes_ctx, key, nonce);
+
+        char out[sizeof(struct account_t)];
+        const char *magic = "OTP2";
+
+        aes_ctr_process(&aes_ctx, magic, out, 4);
+        rb->write(fd, out, 4);
+
+        for(int i = 0; i < next_slot; ++i)
+        {
+            aes_ctr_process(&aes_ctx, (char*)accounts + i, out, sizeof(struct account_t));
+            rb->write(fd, out, sizeof(out));
+        }
+
+        aes_ctr_destroy(&aes_ctx);
+    }
+    else
+        for(int i = 0; i < next_slot; ++i)
+            rb->write(fd, accounts + i, sizeof(struct account_t));
 
-    for(int i = 0; i < next_slot; ++i)
-        rb->write(fd, accounts + i, sizeof(struct account_t));
     rb->close(fd);
 }
 
@@ -274,7 +430,7 @@ static void add_acct_file(void)
     {
         int fd = rb->open(fname, O_RDONLY);
         do {
-            memset(accounts + next_slot, 0, sizeof(struct account_t));
+            rb->memset(accounts + next_slot, 0, sizeof(struct account_t));
 
             accounts[next_slot].digits = 6;
 
@@ -410,7 +566,7 @@ static void add_acct_manual(void)
         rb->splashf(HZ * 2, "Account limit reached!");
         return;
     }
-    memset(accounts + next_slot, 0, sizeof(struct account_t));
+    rb->memset(accounts + next_slot, 0, sizeof(struct account_t));
 
     rb->splash(HZ * 1, "Enter account name:");
     if(rb->kbd_input(accounts[next_slot].name, sizeof(accounts[next_slot].name)) < 0)
@@ -425,7 +581,7 @@ static void add_acct_manual(void)
     rb->splash(HZ * 2, "Enter Base32-encoded secret:");
 
     char temp_buf[SECRET_MAX * 2];
-    memset(temp_buf, 0, sizeof(temp_buf));
+    rb->memset(temp_buf, 0, sizeof(temp_buf));
 
     if(rb->kbd_input(temp_buf, sizeof(temp_buf)) < 0)
         return;
@@ -445,16 +601,16 @@ static void add_acct_manual(void)
         accounts[next_slot].is_totp = true;
 #endif
 
-    memset(temp_buf, 0, sizeof(temp_buf));
+    rb->memset(temp_buf, 0, sizeof(temp_buf));
 
     if(!accounts[next_slot].is_totp)
     {
-        rb->splash(HZ * 2, "Enter counter (0 is normal):");
+        rb->splash(HZ * 2, "Enter counter (0 is typical):");
         temp_buf[0] = '0';
     }
     else
     {
-        rb->splash(HZ * 2, "Enter time step (30 is normal):");
+        rb->splash(HZ * 2, "Enter time step (30 is typical):");
         temp_buf[0] = '3';
         temp_buf[1] = '0';
     }
@@ -467,9 +623,9 @@ static void add_acct_manual(void)
     else
         accounts[next_slot].totp_period = rb->atoi(temp_buf);
 
-    rb->splash(HZ * 2, "Enter code length (6 is normal):");
+    rb->splash(HZ * 2, "Enter code length (6 is typical):");
 
-    memset(temp_buf, 0, sizeof(temp_buf));
+    rb->memset(temp_buf, 0, sizeof(temp_buf));
     temp_buf[0] = '6';
 
     if(rb->kbd_input(temp_buf, sizeof(temp_buf)) < 0)
@@ -701,7 +857,7 @@ static void edit_menu(int acct)
             break;
         case 4: // secret
             old_len = accounts[acct].sec_len;
-            memcpy(temp_sec, accounts[acct].secret, accounts[acct].sec_len);
+            rb->memcpy(temp_sec, accounts[acct].secret, accounts[acct].sec_len);
             base32_encode(accounts[acct].secret, accounts[acct].sec_len, data_buf, sizeof(data_buf));
 
             if(rb->kbd_input(data_buf, sizeof(data_buf)) < 0)
@@ -710,7 +866,7 @@ static void edit_menu(int acct)
             int ret = base32_decode(accounts[acct].secret, sizeof(accounts[acct].secret), data_buf);
             if(ret <= 0)
             {
-                memcpy(accounts[acct].secret, temp_sec, SECRET_MAX);
+                rb->memcpy(accounts[acct].secret, temp_sec, SECRET_MAX);
                 accounts[acct].sec_len = old_len;
                 rb->splash(HZ * 2, "Invalid Base32 secret!");
                 break;
@@ -726,7 +882,7 @@ static void edit_menu(int acct)
             MENUITEM_STRINGLIST(type_menu, "Choose Type", NULL,
                                 "TOTP",
                                 "HOTP",
-                                "Cancel");
+                                "Back");
             int sel = accounts[acct].is_totp ? 0 : 1;
 
             switch(rb->do_menu(&type_menu, &sel, NULL, false))
@@ -741,6 +897,7 @@ static void edit_menu(int acct)
                 break;
             }
             menu = (accounts[acct].is_totp) ? &menu_2 : &menu_1;
+            break;
         }
         case 6:
 #else
@@ -968,11 +1125,83 @@ static void export_menu(void)
     }
 }
 
+static void encrypt_menu(void)
+{
+    MENUITEM_STRINGLIST(encrypt_menu_1, "Encryption", NULL,
+                        "Change Password",
+                        "Disable",
+                        "Back");
+
+    MENUITEM_STRINGLIST(encrypt_menu_2, "Encryption", NULL,
+                        "Enable",
+                        "Back");
+
+    const struct menu_item_ex *menu = encrypted ? &encrypt_menu_1 : &encrypt_menu_2;
+
+    switch(rb->do_menu(menu, NULL, NULL, false))
+    {
+    case 0:
+    {
+        char temp_pass[sizeof(enc_password)];
+
+        temp_pass[0] = '\0';
+        enc_password[0] = '\0';
+
+        if(encrypted)
+        {
+            rb->splash(HZ * 2, "Enter current password:");
+
+            if(rb->kbd_input(temp_pass, sizeof(temp_pass)) < 0)
+                break;
+
+            if(rb->strcmp(enc_password, temp_pass))
+            {
+                rb->splashf(HZ * 2, "Wrong password!");
+                break;
+            }
+
+            temp_pass[0] = '\0';
+        }
+
+        rb->splash(HZ * 2, "Enter new password:");
+
+        if(rb->kbd_input(temp_pass, sizeof(temp_pass)) < 0)
+            break;
+
+        rb->splash(HZ * 2, "Re-enter new password:");
+
+        if(rb->kbd_input(enc_password, sizeof(enc_password)) < 0)
+            break;
+
+        if(rb->strcmp(temp_pass, enc_password))
+        {
+            rb->splash(HZ * 2, "Passwords do not match!");
+            break;
+        }
+
+        encrypted = true;
+        rb->splash(HZ * 2, "Success.");
+        break;
+    }
+    case 1:
+        if(menu == &encrypt_menu_1)
+        {
+            rb->splash(HZ * 2, "Success.");
+            encrypted = false;
+        }
+        /* fall through */
+    case 2:
+    default:
+        break;
+    }
+}
+
 static void adv_menu(void)
 {
     MENUITEM_STRINGLIST(menu, "Advanced", NULL,
                         "Edit Account",
                         "Export Accounts",
+                        "Encryption",
                         "Delete ALL Accounts",
 #if CONFIG_RTC
                         "Select Time Zone",
@@ -992,6 +1221,11 @@ static void adv_menu(void)
             export_menu();
             break;
         case 2:
+        {
+            encrypt_menu();
+            break;
+        }
+        case 3:
             if(danger_confirm())
             {
                 next_slot = 0;
@@ -1002,12 +1236,12 @@ static void adv_menu(void)
                 rb->splash(HZ, "Not confirmed.");
             break;
 #if CONFIG_RTC
-        case 3:
+        case 4:
             time_offs = get_time_offs();
             break;
-        case 4:
+        case 5:
 #else
-        case 3:
+        case 4:
 #endif
             quit = 1;
             break;