mirror of
https://github.com/Ed94/Odin.git
synced 2026-08-05 15:18:49 +00:00
core/crypto/aegis: Initial import
This commit is contained in:
Yawning Angel
@@ -0,0 +1,213 @@
|
||||
/*
|
||||
package aegis implements the AEGIS-128L and AEGIS-256 Authenticated
|
||||
Encryption with Additional Data algorithms.
|
||||
|
||||
See:
|
||||
- [[ https://www.ietf.org/archive/id/draft-irtf-cfrg-aegis-aead-12.txt ]]
|
||||
*/
|
||||
package aegis
|
||||
|
||||
import "core:bytes"
|
||||
import "core:crypto"
|
||||
import "core:crypto/aes"
|
||||
import "core:mem"
|
||||
|
||||
// KEY_SIZE_128L is the AEGIS-128L key size in bytes.
|
||||
KEY_SIZE_128L :: 16
|
||||
// KEY_SIZE_256 is the AEGIS-256 key size in bytes.
|
||||
KEY_SIZE_256 :: 32
|
||||
// IV_SIZE_128L is the AEGIS-128L IV size in bytes.
|
||||
IV_SIZE_128L :: 16
|
||||
// IV_SIZE_256 is the AEGIS-256 IV size in bytes.
|
||||
IV_SIZE_256 :: 32
|
||||
// TAG_SIZE_128 is the AEGIS-128L or AEGIS-256 128-bit tag size in bytes.
|
||||
TAG_SIZE_128 :: 16
|
||||
// TAG_SIZE_256 is the AEGIS-128L or AEGIS-256 256-bit tag size in bytes.
|
||||
TAG_SIZE_256 :: 32
|
||||
|
||||
@(private)
|
||||
_RATE_128L :: 32
|
||||
@(private)
|
||||
_RATE_256 :: 16
|
||||
@(private)
|
||||
_RATE_MAX :: _RATE_128L
|
||||
|
||||
@(private, rodata)
|
||||
_C0 := [16]byte{
|
||||
0x00, 0x01, 0x01, 0x02, 0x03, 0x05, 0x08, 0x0d,
|
||||
0x15, 0x22, 0x37, 0x59, 0x90, 0xe9, 0x79, 0x62,
|
||||
}
|
||||
|
||||
@(private, rodata)
|
||||
_C1 := [16]byte {
|
||||
0xdb, 0x3d, 0x18, 0x55, 0x6d, 0xc2, 0x2f, 0xf1,
|
||||
0x20, 0x11, 0x31, 0x42, 0x73, 0xb5, 0x28, 0xdd,
|
||||
}
|
||||
|
||||
// Context is a keyed AEGIS-128L or AEGIS-256 instance.
|
||||
Context :: struct {
|
||||
_key: [KEY_SIZE_256]byte,
|
||||
_key_len: int,
|
||||
_impl: aes.Implementation,
|
||||
_is_initialized: bool,
|
||||
}
|
||||
|
||||
@(private)
|
||||
_validate_common_slice_sizes :: proc (ctx: ^Context, tag, iv, aad, text: []byte) {
|
||||
switch len(tag) {
|
||||
case TAG_SIZE_128, TAG_SIZE_256:
|
||||
case:
|
||||
panic("crypto/aegis: invalid tag size")
|
||||
}
|
||||
|
||||
iv_ok: bool
|
||||
switch ctx._key_len {
|
||||
case KEY_SIZE_128L:
|
||||
iv_ok = len(iv) == IV_SIZE_128L
|
||||
case KEY_SIZE_256:
|
||||
iv_ok = len(iv) == IV_SIZE_256
|
||||
}
|
||||
ensure(iv_ok,"crypto/aegis: invalid IV size")
|
||||
|
||||
#assert(size_of(int) == 8 || size_of(int) <= 4)
|
||||
// As A_MAX and P_MAX are both defined to be 2^61 - 1 bytes, and
|
||||
// the maximum length of a slice is bound by `size_of(int)`, where
|
||||
// `int` is register sized, there is no need to check AAD/text
|
||||
// lengths.
|
||||
}
|
||||
|
||||
// init initializes a Context with the provided key, for AEGIS-128L or AEGIS-256.
|
||||
init :: proc(ctx: ^Context, key: []byte, impl := aes.DEFAULT_IMPLEMENTATION) {
|
||||
switch len(key) {
|
||||
case KEY_SIZE_128L, KEY_SIZE_256:
|
||||
case:
|
||||
panic("crypto/aegis: invalid key size")
|
||||
}
|
||||
|
||||
copy(ctx._key[:], key)
|
||||
ctx._key_len = len(key)
|
||||
ctx._impl = impl
|
||||
if ctx._impl == .Hardware && !is_hardware_accelerated() {
|
||||
ctx._impl = .Portable
|
||||
}
|
||||
ctx._is_initialized = true
|
||||
}
|
||||
|
||||
// seal encrypts the plaintext and authenticates the aad and ciphertext,
|
||||
// with the provided Context and iv, stores the output in dst and tag.
|
||||
//
|
||||
// dst and plaintext MUST alias exactly or not at all.
|
||||
seal :: proc(ctx: ^Context, dst, tag, iv, aad, plaintext: []byte) {
|
||||
ensure(ctx._is_initialized)
|
||||
|
||||
_validate_common_slice_sizes(ctx, tag, iv, aad, plaintext)
|
||||
ensure(len(dst) == len(plaintext), "crypto/aegis: invalid destination ciphertext size")
|
||||
ensure(!bytes.alias_inexactly(dst, plaintext), "crypto/aegis: dst and plaintext alias inexactly")
|
||||
|
||||
switch ctx._impl {
|
||||
case .Hardware:
|
||||
st: State_HW
|
||||
defer reset_state_hw(&st)
|
||||
|
||||
init_hw(ctx, &st, iv)
|
||||
|
||||
aad_len, pt_len := len(aad), len(plaintext)
|
||||
if aad_len > 0 {
|
||||
absorb_hw(&st, aad)
|
||||
}
|
||||
|
||||
if pt_len > 0 {
|
||||
enc_hw(&st, dst, plaintext)
|
||||
}
|
||||
|
||||
finalize_hw(&st, tag, aad_len, pt_len)
|
||||
case .Portable:
|
||||
st: State_SW
|
||||
defer reset_state_sw(&st)
|
||||
|
||||
init_sw(ctx, &st, iv)
|
||||
|
||||
aad_len, pt_len := len(aad), len(plaintext)
|
||||
if aad_len > 0 {
|
||||
absorb_sw(&st, aad)
|
||||
}
|
||||
|
||||
if pt_len > 0 {
|
||||
enc_sw(&st, dst, plaintext)
|
||||
}
|
||||
|
||||
finalize_sw(&st, tag, aad_len, pt_len)
|
||||
case:
|
||||
panic("core/crypto/aegis: not implemented")
|
||||
}
|
||||
}
|
||||
|
||||
// open authenticates the aad and ciphertext, and decrypts the ciphertext,
|
||||
// with the provided Context, iv, and tag, and stores the output in dst,
|
||||
// returning true iff the authentication was successful. If authentication
|
||||
// fails, the destination buffer will be zeroed.
|
||||
//
|
||||
// dst and plaintext MUST alias exactly or not at all.
|
||||
@(require_results)
|
||||
open :: proc(ctx: ^Context, dst, iv, aad, ciphertext, tag: []byte) -> bool {
|
||||
ensure(ctx._is_initialized)
|
||||
|
||||
_validate_common_slice_sizes(ctx, tag, iv, aad, ciphertext)
|
||||
ensure(len(dst) == len(ciphertext), "crypto/aegis: invalid destination plaintext size")
|
||||
ensure(!bytes.alias_inexactly(dst, ciphertext), "crypto/aegis: dst and ciphertext alias inexactly")
|
||||
|
||||
tmp: [TAG_SIZE_256]byte
|
||||
derived_tag := tmp[:len(tag)]
|
||||
aad_len, ct_len := len(aad), len(ciphertext)
|
||||
|
||||
switch ctx._impl {
|
||||
case .Hardware:
|
||||
st: State_HW
|
||||
defer reset_state_hw(&st)
|
||||
|
||||
init_hw(ctx, &st, iv)
|
||||
|
||||
if aad_len > 0 {
|
||||
absorb_hw(&st, aad)
|
||||
}
|
||||
|
||||
if ct_len > 0 {
|
||||
dec_hw(&st, dst, ciphertext)
|
||||
}
|
||||
|
||||
finalize_hw(&st, derived_tag, aad_len, ct_len)
|
||||
case .Portable:
|
||||
st: State_SW
|
||||
defer reset_state_sw(&st)
|
||||
|
||||
init_sw(ctx, &st, iv)
|
||||
|
||||
if aad_len > 0 {
|
||||
absorb_sw(&st, aad)
|
||||
}
|
||||
|
||||
if ct_len > 0 {
|
||||
dec_sw(&st, dst, ciphertext)
|
||||
}
|
||||
|
||||
finalize_sw(&st, derived_tag, aad_len, ct_len)
|
||||
case:
|
||||
panic("core/crypto/aegis: not implemented")
|
||||
}
|
||||
|
||||
if crypto.compare_constant_time(tag, derived_tag) != 1 {
|
||||
mem.zero_explicit(raw_data(derived_tag), len(derived_tag))
|
||||
mem.zero_explicit(raw_data(dst), ct_len)
|
||||
return false
|
||||
}
|
||||
|
||||
return true
|
||||
}
|
||||
|
||||
// reset sanitizes the Context. The Context must be
|
||||
// re-initialized to be used again.
|
||||
reset :: proc "contextless" (ctx: ^Context) {
|
||||
mem.zero_explicit(&ctx._key, len(ctx._key))
|
||||
ctx._key_len = 0
|
||||
ctx._is_initialized = false
|
||||
}
|
||||
@@ -0,0 +1,452 @@
|
||||
package aegis
|
||||
|
||||
import aes "core:crypto/_aes/ct64"
|
||||
import "core:encoding/endian"
|
||||
import "core:mem"
|
||||
|
||||
// This uses the bitlsiced 64-bit general purpose register SWAR AES
|
||||
// round function. The intermediate state is stored in interleaved
|
||||
// but NOT orthogonalized form, as leaving things in the orthgonalized
|
||||
// format would overly complicate the update implementation.
|
||||
//
|
||||
// Note/perf: Per Frank Denis and a review of the specification, it is
|
||||
// possible to gain slightly more performance by leaving the state in
|
||||
// orthogonalized form while doing initialization, finalization, and
|
||||
// absorbing AAD. This implementation opts out of those optimizations
|
||||
// for the sake of simplicity.
|
||||
//
|
||||
// The update function leverages the paralleism (4xblocks) at once.
|
||||
|
||||
@(private)
|
||||
State_SW :: struct {
|
||||
s0_0, s0_1: u64,
|
||||
s1_0, s1_1: u64,
|
||||
s2_0, s2_1: u64,
|
||||
s3_0, s3_1: u64,
|
||||
s4_0, s4_1: u64,
|
||||
s5_0, s5_1: u64,
|
||||
s6_0, s6_1: u64,
|
||||
s7_0, s7_1: u64,
|
||||
q_k, q_b: [8]u64,
|
||||
rate: int,
|
||||
}
|
||||
|
||||
@(private)
|
||||
init_sw :: proc "contextless" (ctx: ^Context, st: ^State_SW, iv: []byte) {
|
||||
switch ctx._key_len {
|
||||
case KEY_SIZE_128L:
|
||||
key_0, key_1 := aes.load_interleaved(ctx._key[:16])
|
||||
iv_0, iv_1 := aes.load_interleaved(iv)
|
||||
|
||||
st.s0_0, st.s0_1 = aes.xor_interleaved(key_0, key_1, iv_0, iv_1)
|
||||
st.s1_0, st.s1_1 = aes.load_interleaved(_C1[:])
|
||||
st.s2_0, st.s2_1 = aes.load_interleaved(_C0[:])
|
||||
st.s3_0, st.s3_1 = st.s1_0, st.s1_1
|
||||
st.s4_0, st.s4_1 = st.s0_0, st.s0_1
|
||||
st.s5_0, st.s5_1 = aes.xor_interleaved(key_0, key_1, st.s2_0, st.s2_1)
|
||||
st.s6_0, st.s6_1 = aes.xor_interleaved(key_0, key_1, st.s1_0, st.s1_1)
|
||||
st.s7_0, st.s7_1 = st.s5_0, st.s5_1
|
||||
st.rate = _RATE_128L
|
||||
|
||||
for _ in 0 ..< 10 {
|
||||
update_sw_128l(st, iv_0, iv_1, key_0, key_1)
|
||||
}
|
||||
case KEY_SIZE_256:
|
||||
k0_0, k0_1 := aes.load_interleaved(ctx._key[:16])
|
||||
k1_0, k1_1 := aes.load_interleaved(ctx._key[16:])
|
||||
n0_0, n0_1 := aes.load_interleaved(iv[:16])
|
||||
n1_0, n1_1 := aes.load_interleaved(iv[16:])
|
||||
|
||||
st.s0_0, st.s0_1 = aes.xor_interleaved(k0_0, k0_1, n0_0, n0_1)
|
||||
st.s1_0, st.s1_1 = aes.xor_interleaved(k1_0, k1_1, n1_0, n1_1)
|
||||
st.s2_0, st.s2_1 = aes.load_interleaved(_C1[:])
|
||||
st.s3_0, st.s3_1 = aes.load_interleaved(_C0[:])
|
||||
st.s4_0, st.s4_1 = aes.xor_interleaved(k0_0, k0_1, st.s3_0, st.s3_1)
|
||||
st.s5_0, st.s5_1 = aes.xor_interleaved(k1_0, k1_1, st.s2_0, st.s2_1)
|
||||
st.rate = _RATE_256
|
||||
|
||||
u0_0, u0_1, u1_0, u1_1 := st.s0_0, st.s0_1, st.s1_0, st.s1_1
|
||||
for _ in 0 ..< 4 {
|
||||
update_sw_256(st, k0_0, k0_1)
|
||||
update_sw_256(st, k1_0, k1_1)
|
||||
update_sw_256(st, u0_0, u0_1)
|
||||
update_sw_256(st, u1_0, u1_1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
update_sw_128l :: proc "contextless" (st: ^State_SW, m0_0, m0_1, m1_0, m1_1: u64) {
|
||||
st.q_k[0], st.q_k[4] = aes.xor_interleaved(st.s0_0, st.s0_1, m0_0, m0_1)
|
||||
st.q_k[1], st.q_k[5] = st.s1_0, st.s1_1
|
||||
st.q_k[2], st.q_k[6] = st.s2_0, st.s2_1
|
||||
st.q_k[3], st.q_k[7] = st.s3_0, st.s3_1
|
||||
aes.orthogonalize(&st.q_k)
|
||||
|
||||
st.q_b[0], st.q_b[4] = st.s7_0, st.s7_1
|
||||
st.q_b[1], st.q_b[5] = st.s0_0, st.s0_1
|
||||
st.q_b[2], st.q_b[6] = st.s1_0, st.s1_1
|
||||
st.q_b[3], st.q_b[7] = st.s2_0, st.s2_1
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
aes.sub_bytes(&st.q_b)
|
||||
aes.shift_rows(&st.q_b)
|
||||
aes.mix_columns(&st.q_b)
|
||||
aes.add_round_key(&st.q_b, st.q_k[:])
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
st.s0_0, st.s0_1 = st.q_b[0], st.q_b[4]
|
||||
st.s1_0, st.s1_1 = st.q_b[1], st.q_b[5]
|
||||
st.s2_0, st.s2_1 = st.q_b[2], st.q_b[6]
|
||||
s3_0, s3_1 := st.q_b[3], st.q_b[7]
|
||||
|
||||
st.q_k[0], st.q_k[4] = aes.xor_interleaved(st.s4_0, st.s4_1, m1_0, m1_1)
|
||||
st.q_k[1], st.q_k[5] = st.s5_0, st.s5_1
|
||||
st.q_k[2], st.q_k[6] = st.s6_0, st.s6_1
|
||||
st.q_k[3], st.q_k[7] = st.s7_0, st.s7_1
|
||||
aes.orthogonalize(&st.q_k)
|
||||
|
||||
st.q_b[0], st.q_b[4] = st.s3_0, st.s3_1
|
||||
st.q_b[1], st.q_b[5] = st.s4_0, st.s4_1
|
||||
st.q_b[2], st.q_b[6] = st.s5_0, st.s5_1
|
||||
st.q_b[3], st.q_b[7] = st.s6_0, st.s6_1
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
aes.sub_bytes(&st.q_b)
|
||||
aes.shift_rows(&st.q_b)
|
||||
aes.mix_columns(&st.q_b)
|
||||
aes.add_round_key(&st.q_b, st.q_k[:])
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
st.s3_0, st.s3_1 = s3_0, s3_1
|
||||
st.s4_0, st.s4_1 = st.q_b[0], st.q_b[4]
|
||||
st.s5_0, st.s5_1 = st.q_b[1], st.q_b[5]
|
||||
st.s6_0, st.s6_1 = st.q_b[2], st.q_b[6]
|
||||
st.s7_0, st.s7_1 = st.q_b[3], st.q_b[7]
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
update_sw_256 :: proc "contextless" (st: ^State_SW, m_0, m_1: u64) {
|
||||
st.q_k[0], st.q_k[4] = aes.xor_interleaved(st.s0_0, st.s0_1, m_0, m_1)
|
||||
st.q_k[1], st.q_k[5] = st.s1_0, st.s1_1
|
||||
st.q_k[2], st.q_k[6] = st.s2_0, st.s2_1
|
||||
st.q_k[3], st.q_k[7] = st.s3_0, st.s3_1
|
||||
aes.orthogonalize(&st.q_k)
|
||||
|
||||
st.q_b[0], st.q_b[4] = st.s5_0, st.s5_1
|
||||
st.q_b[1], st.q_b[5] = st.s0_0, st.s0_1
|
||||
st.q_b[2], st.q_b[6] = st.s1_0, st.s1_1
|
||||
st.q_b[3], st.q_b[7] = st.s2_0, st.s2_1
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
aes.sub_bytes(&st.q_b)
|
||||
aes.shift_rows(&st.q_b)
|
||||
aes.mix_columns(&st.q_b)
|
||||
aes.add_round_key(&st.q_b, st.q_k[:])
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
st.s0_0, st.s0_1 = st.q_b[0], st.q_b[4]
|
||||
st.s1_0, st.s1_1 = st.q_b[1], st.q_b[5]
|
||||
st.s2_0, st.s2_1 = st.q_b[2], st.q_b[6]
|
||||
s3_0, s3_1 := st.q_b[3], st.q_b[7]
|
||||
|
||||
st.q_k[0], st.q_k[4] = st.s4_0, st.s4_1
|
||||
st.q_k[1], st.q_k[5] = st.s5_0, st.s5_1
|
||||
aes.orthogonalize(&st.q_k)
|
||||
|
||||
st.q_b[0], st.q_b[4] = st.s3_0, st.s3_1
|
||||
st.q_b[1], st.q_b[5] = st.s4_0, st.s4_1
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
aes.sub_bytes(&st.q_b)
|
||||
aes.shift_rows(&st.q_b)
|
||||
aes.mix_columns(&st.q_b)
|
||||
aes.add_round_key(&st.q_b, st.q_k[:])
|
||||
aes.orthogonalize(&st.q_b)
|
||||
|
||||
st.s3_0, st.s3_1 = s3_0, s3_1
|
||||
st.s4_0, st.s4_1 = st.q_b[0], st.q_b[4]
|
||||
st.s5_0, st.s5_1 = st.q_b[1], st.q_b[5]
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
absorb_sw_128l :: #force_inline proc "contextless" (st: ^State_SW, ai: []byte) #no_bounds_check {
|
||||
t0_0, t0_1 := aes.load_interleaved(ai[:16])
|
||||
t1_0, t1_1 := aes.load_interleaved(ai[16:])
|
||||
update_sw_128l(st, t0_0, t0_1, t1_0, t1_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
absorb_sw_256 :: #force_inline proc "contextless" (st: ^State_SW, ai: []byte) {
|
||||
m_0, m_1 := aes.load_interleaved(ai)
|
||||
update_sw_256(st, m_0, m_1)
|
||||
}
|
||||
|
||||
@(private)
|
||||
absorb_sw :: proc "contextless" (st: ^State_SW, aad: []byte) #no_bounds_check {
|
||||
ai, l := aad, len(aad)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
absorb_sw_128l(st, ai)
|
||||
ai = ai[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
absorb_sw_256(st, ai)
|
||||
|
||||
ai = ai[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Pad out the remainder with `0`s till it is rate sized.
|
||||
if l > 0 {
|
||||
tmp: [_RATE_MAX]byte // AAD is not confidential.
|
||||
copy(tmp[:], ai)
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
absorb_sw_128l(st, tmp[:])
|
||||
case _RATE_256:
|
||||
absorb_sw_256(st, tmp[:])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file", require_results)
|
||||
z_sw_128l :: proc "contextless" (st: ^State_SW) -> (u64, u64, u64, u64) {
|
||||
z0_0, z0_1 := aes.and_interleaved(st.s2_0, st.s2_1, st.s3_0, st.s3_1)
|
||||
z0_0, z0_1 = aes.xor_interleaved(st.s1_0, st.s1_1, z0_0, z0_1)
|
||||
z0_0, z0_1 = aes.xor_interleaved(st.s6_0, st.s6_1, z0_0, z0_1)
|
||||
|
||||
z1_0, z1_1 := aes.and_interleaved(st.s6_0, st.s6_1, st.s7_0, st.s7_1)
|
||||
z1_0, z1_1 = aes.xor_interleaved(st.s5_0, st.s5_1, z1_0, z1_1)
|
||||
z1_0, z1_1 = aes.xor_interleaved(st.s2_0, st.s2_1, z1_0, z1_1)
|
||||
|
||||
return z0_0, z0_1, z1_0, z1_1
|
||||
}
|
||||
|
||||
@(private = "file", require_results)
|
||||
z_sw_256 :: proc "contextless" (st: ^State_SW) -> (u64, u64) {
|
||||
z_0, z_1 := aes.and_interleaved(st.s2_0, st.s2_1, st.s3_0, st.s3_1)
|
||||
z_0, z_1 = aes.xor_interleaved(st.s5_0, st.s5_1, z_0, z_1)
|
||||
z_0, z_1 = aes.xor_interleaved(st.s4_0, st.s4_1, z_0, z_1)
|
||||
return aes.xor_interleaved(st.s1_0, st.s1_1, z_0, z_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
enc_sw_128l :: #force_inline proc "contextless" (st: ^State_SW, ci, xi: []byte) #no_bounds_check {
|
||||
z0_0, z0_1, z1_0, z1_1 := z_sw_128l(st)
|
||||
|
||||
t0_0, t0_1 := aes.load_interleaved(xi[:16])
|
||||
t1_0, t1_1 := aes.load_interleaved(xi[16:])
|
||||
update_sw_128l(st, t0_0, t0_1, t1_0, t1_1)
|
||||
|
||||
out0_0, out0_1 := aes.xor_interleaved(t0_0, t0_1, z0_0, z0_1)
|
||||
out1_0, out1_1 := aes.xor_interleaved(t1_0, t1_1, z1_0, z1_1)
|
||||
aes.store_interleaved(ci[:16], out0_0, out0_1)
|
||||
aes.store_interleaved(ci[16:], out1_0, out1_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
enc_sw_256 :: #force_inline proc "contextless" (st: ^State_SW, ci, xi: []byte) #no_bounds_check {
|
||||
z_0, z_1 := z_sw_256(st)
|
||||
|
||||
xi_0, xi_1 := aes.load_interleaved(xi)
|
||||
update_sw_256(st, xi_0, xi_1)
|
||||
|
||||
ci_0, ci_1 := aes.xor_interleaved(xi_0, xi_1, z_0, z_1)
|
||||
aes.store_interleaved(ci, ci_0, ci_1)
|
||||
}
|
||||
|
||||
@(private)
|
||||
enc_sw :: proc "contextless" (st: ^State_SW, dst, src: []byte) #no_bounds_check {
|
||||
ci, xi, l := dst, src, len(src)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
enc_sw_128l(st, ci, xi)
|
||||
ci = ci[_RATE_128L:]
|
||||
xi = xi[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
enc_sw_256(st, ci, xi)
|
||||
ci = ci[_RATE_256:]
|
||||
xi = xi[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Pad out the remainder with `0`s till it is rate sized.
|
||||
if l > 0 {
|
||||
tmp: [_RATE_MAX]byte // Ciphertext is not confidential.
|
||||
copy(tmp[:], xi)
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
enc_sw_128l(st, tmp[:], tmp[:])
|
||||
case _RATE_256:
|
||||
enc_sw_256(st, tmp[:], tmp[:])
|
||||
}
|
||||
copy(ci, tmp[:l])
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
dec_sw_128l :: #force_inline proc "contextless" (st: ^State_SW, xi, ci: []byte) #no_bounds_check {
|
||||
z0_0, z0_1, z1_0, z1_1 := z_sw_128l(st)
|
||||
|
||||
t0_0, t0_1 := aes.load_interleaved(ci[:16])
|
||||
t1_0, t1_1 := aes.load_interleaved(ci[16:])
|
||||
out0_0, out0_1 := aes.xor_interleaved(t0_0, t0_1, z0_0, z0_1)
|
||||
out1_0, out1_1 := aes.xor_interleaved(t1_0, t1_1, z1_0, z1_1)
|
||||
|
||||
update_sw_128l(st, out0_0, out0_1, out1_0, out1_1)
|
||||
aes.store_interleaved(xi[:16], out0_0, out0_1)
|
||||
aes.store_interleaved(xi[16:], out1_0, out1_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
dec_sw_256 :: #force_inline proc "contextless" (st: ^State_SW, xi, ci: []byte) #no_bounds_check {
|
||||
z_0, z_1 := z_sw_256(st)
|
||||
|
||||
ci_0, ci_1 := aes.load_interleaved(ci)
|
||||
xi_0, xi_1 := aes.xor_interleaved(ci_0, ci_1, z_0, z_1)
|
||||
|
||||
update_sw_256(st, xi_0, xi_1)
|
||||
aes.store_interleaved(xi, xi_0, xi_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
dec_partial_sw_128l :: proc "contextless" (st: ^State_SW, xn, cn: []byte) #no_bounds_check {
|
||||
tmp: [_RATE_128L]byte
|
||||
defer mem.zero_explicit(&tmp, size_of(tmp))
|
||||
|
||||
z0_0, z0_1, z1_0, z1_1 := z_sw_128l(st)
|
||||
copy(tmp[:], cn)
|
||||
|
||||
t0_0, t0_1 := aes.load_interleaved(tmp[:16])
|
||||
t1_0, t1_1 := aes.load_interleaved(tmp[16:])
|
||||
out0_0, out0_1 := aes.xor_interleaved(t0_0, t0_1, z0_0, z0_1)
|
||||
out1_0, out1_1 := aes.xor_interleaved(t1_0, t1_1, z1_0, z1_1)
|
||||
|
||||
aes.store_interleaved(tmp[:16], out0_0, out0_1)
|
||||
aes.store_interleaved(tmp[16:], out1_0, out1_1)
|
||||
copy(xn, tmp[:])
|
||||
|
||||
for off := len(xn); off < _RATE_128L; off += 1 {
|
||||
tmp[off] = 0
|
||||
}
|
||||
out0_0, out0_1 = aes.load_interleaved(tmp[:16])
|
||||
out1_0, out1_1 = aes.load_interleaved(tmp[16:])
|
||||
update_sw_128l(st, out0_0, out0_1, out1_0, out1_1)
|
||||
}
|
||||
|
||||
@(private = "file")
|
||||
dec_partial_sw_256 :: proc "contextless" (st: ^State_SW, xn, cn: []byte) #no_bounds_check {
|
||||
tmp: [_RATE_256]byte
|
||||
defer mem.zero_explicit(&tmp, size_of(tmp))
|
||||
|
||||
z_0, z_1 := z_sw_256(st)
|
||||
copy(tmp[:], cn)
|
||||
|
||||
cn_0, cn_1 := aes.load_interleaved(tmp[:])
|
||||
xn_0, xn_1 := aes.xor_interleaved(cn_0, cn_1, z_0, z_1)
|
||||
|
||||
aes.store_interleaved(tmp[:], xn_0, xn_1)
|
||||
copy(xn, tmp[:])
|
||||
|
||||
for off := len(xn); off < _RATE_256; off += 1 {
|
||||
tmp[off] = 0
|
||||
}
|
||||
xn_0, xn_1 = aes.load_interleaved(tmp[:])
|
||||
update_sw_256(st, xn_0, xn_1)
|
||||
}
|
||||
|
||||
@(private)
|
||||
dec_sw :: proc "contextless" (st: ^State_SW, dst, src: []byte) #no_bounds_check {
|
||||
xi, ci, l := dst, src, len(src)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
dec_sw_128l(st, xi, ci)
|
||||
xi = xi[_RATE_128L:]
|
||||
ci = ci[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
dec_sw_256(st, xi, ci)
|
||||
xi = xi[_RATE_256:]
|
||||
ci = ci[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Process the remainder.
|
||||
if l > 0 {
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
dec_partial_sw_128l(st, xi, ci)
|
||||
case _RATE_256:
|
||||
dec_partial_sw_256(st, xi, ci)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private)
|
||||
finalize_sw :: proc "contextless" (st: ^State_SW, tag: []byte, ad_len, msg_len: int) {
|
||||
tmp: [16]byte
|
||||
endian.unchecked_put_u64le(tmp[0:], u64(ad_len) * 8)
|
||||
endian.unchecked_put_u64le(tmp[8:], u64(msg_len) * 8)
|
||||
|
||||
t_0, t_1 := aes.load_interleaved(tmp[:])
|
||||
|
||||
t0_0, t0_1, t1_0, t1_1: u64 = ---, ---, ---, ---
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
t_0, t_1 = aes.xor_interleaved(st.s2_0, st.s2_1, t_0, t_1)
|
||||
for _ in 0 ..< 7 {
|
||||
update_sw_128l(st, t_0, t_1, t_0, t_1)
|
||||
}
|
||||
|
||||
t0_0, t0_1 = aes.xor_interleaved(st.s0_0, st.s0_1, st.s1_0, st.s1_1)
|
||||
t0_0, t0_1 = aes.xor_interleaved(t0_0, t0_1, st.s2_0, st.s2_1)
|
||||
t0_0, t0_1 = aes.xor_interleaved(t0_0, t0_1, st.s3_0, st.s3_1)
|
||||
|
||||
t1_0, t1_1 = aes.xor_interleaved(st.s4_0, st.s4_1, st.s5_0, st.s5_1)
|
||||
t1_0, t1_1 = aes.xor_interleaved(t1_0, t1_1, st.s6_0, st.s6_1)
|
||||
if len(tag) == TAG_SIZE_256 {
|
||||
t1_0, t1_1 = aes.xor_interleaved(t1_0, t1_1, st.s7_0, st.s7_1)
|
||||
}
|
||||
case _RATE_256:
|
||||
t_0, t_1 = aes.xor_interleaved(st.s3_0, st.s3_1, t_0, t_1)
|
||||
for _ in 0 ..< 7 {
|
||||
update_sw_256(st, t_0, t_1)
|
||||
}
|
||||
|
||||
t0_0, t0_1 = aes.xor_interleaved(st.s0_0, st.s0_1, st.s1_0, st.s1_1)
|
||||
t0_0, t0_1 = aes.xor_interleaved(t0_0, t0_1, st.s2_0, st.s2_1)
|
||||
|
||||
t1_0, t1_1 = aes.xor_interleaved(st.s3_0, st.s3_1, st.s4_0, st.s4_1)
|
||||
t1_0, t1_1 = aes.xor_interleaved(t1_0, t1_1, st.s5_0, st.s5_1)
|
||||
}
|
||||
switch len(tag) {
|
||||
case TAG_SIZE_128:
|
||||
t0_0, t0_1 = aes.xor_interleaved(t0_0, t0_1, t1_0, t1_1)
|
||||
aes.store_interleaved(tag, t0_0, t0_1)
|
||||
case TAG_SIZE_256:
|
||||
aes.store_interleaved(tag[:16], t0_0, t0_1)
|
||||
aes.store_interleaved(tag[16:], t1_0, t1_1)
|
||||
}
|
||||
}
|
||||
|
||||
@(private)
|
||||
reset_state_sw :: proc "contextless" (st: ^State_SW) {
|
||||
mem.zero_explicit(st, size_of(st^))
|
||||
}
|
||||
@@ -0,0 +1,44 @@
|
||||
#+build !amd64
|
||||
package aegis
|
||||
|
||||
@(private = "file")
|
||||
ERR_HW_NOT_SUPPORTED :: "crypto/aegis: hardware implementation unsupported"
|
||||
|
||||
@(private)
|
||||
State_HW :: struct {}
|
||||
|
||||
// is_hardware_accelerated returns true iff hardware accelerated AEGIS
|
||||
// is supported.
|
||||
is_hardware_accelerated :: proc "contextless" () -> bool {
|
||||
return false
|
||||
}
|
||||
|
||||
@(private)
|
||||
init_hw :: proc "contextless" (ctx: ^Context, st: ^State_HW, iv: []byte) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
|
||||
@(private)
|
||||
absorb_hw :: proc "contextless" (st: ^State_HW, aad: []byte) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
|
||||
@(private)
|
||||
enc_hw :: proc "contextless" (st: ^State_HW, dst, src: []byte) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
|
||||
@(private)
|
||||
dec_hw :: proc "contextless" (st: ^State_HW, dst, src: []byte) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
|
||||
@(private)
|
||||
finalize_hw :: proc "contextless" (st: ^State_HW, tag: []byte, ad_len, msg_len: int) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
|
||||
@(private)
|
||||
reset_state_hw :: proc "contextless" (st: ^State_HW) {
|
||||
panic_contextless(ERR_HW_NOT_SUPPORTED)
|
||||
}
|
||||
@@ -0,0 +1,389 @@
|
||||
#+build amd64
|
||||
package aegis
|
||||
|
||||
import "base:intrinsics"
|
||||
import "core:crypto/aes"
|
||||
import "core:encoding/endian"
|
||||
import "core:mem"
|
||||
import "core:simd/x86"
|
||||
|
||||
@(private)
|
||||
State_HW :: struct {
|
||||
s0: x86.__m128i,
|
||||
s1: x86.__m128i,
|
||||
s2: x86.__m128i,
|
||||
s3: x86.__m128i,
|
||||
s4: x86.__m128i,
|
||||
s5: x86.__m128i,
|
||||
s6: x86.__m128i,
|
||||
s7: x86.__m128i,
|
||||
rate: int,
|
||||
}
|
||||
|
||||
// is_hardware_accelerated returns true iff hardware accelerated AEGIS
|
||||
// is supported.
|
||||
is_hardware_accelerated :: proc "contextless" () -> bool {
|
||||
return aes.is_hardware_accelerated()
|
||||
}
|
||||
|
||||
@(private, enable_target_feature = "sse2,aes")
|
||||
init_hw :: proc "contextless" (ctx: ^Context, st: ^State_HW, iv: []byte) {
|
||||
switch ctx._key_len {
|
||||
case KEY_SIZE_128L:
|
||||
key := intrinsics.unaligned_load((^x86.__m128i)(&ctx._key[0]))
|
||||
iv := intrinsics.unaligned_load((^x86.__m128i)(raw_data(iv)))
|
||||
|
||||
st.s0 = x86._mm_xor_si128(key, iv)
|
||||
st.s1 = intrinsics.unaligned_load((^x86.__m128i)(&_C1[0]))
|
||||
st.s2 = intrinsics.unaligned_load((^x86.__m128i)(&_C0[0]))
|
||||
st.s3 = st.s1
|
||||
st.s4 = st.s0
|
||||
st.s5 = x86._mm_xor_si128(key, st.s2) // key ^ C0
|
||||
st.s6 = x86._mm_xor_si128(key, st.s1) // key ^ C1
|
||||
st.s7 = st.s5
|
||||
st.rate = _RATE_128L
|
||||
|
||||
for _ in 0 ..< 10 {
|
||||
update_hw_128l(st, iv, key)
|
||||
}
|
||||
case KEY_SIZE_256:
|
||||
k0 := intrinsics.unaligned_load((^x86.__m128i)(&ctx._key[0]))
|
||||
k1 := intrinsics.unaligned_load((^x86.__m128i)(&ctx._key[16]))
|
||||
n0 := intrinsics.unaligned_load((^x86.__m128i)(&iv[0]))
|
||||
n1 := intrinsics.unaligned_load((^x86.__m128i)(&iv[16]))
|
||||
|
||||
st.s0 = x86._mm_xor_si128(k0, n0)
|
||||
st.s1 = x86._mm_xor_si128(k1, n1)
|
||||
st.s2 = intrinsics.unaligned_load((^x86.__m128i)(&_C1[0]))
|
||||
st.s3 = intrinsics.unaligned_load((^x86.__m128i)(&_C0[0]))
|
||||
st.s4 = x86._mm_xor_si128(k0, st.s3) // k0 ^ C0
|
||||
st.s5 = x86._mm_xor_si128(k1, st.s2) // k1 ^ C1
|
||||
st.rate = _RATE_256
|
||||
|
||||
u0, u1 := st.s0, st.s1
|
||||
for _ in 0 ..< 4 {
|
||||
update_hw_256(st, k0)
|
||||
update_hw_256(st, k1)
|
||||
update_hw_256(st, u0)
|
||||
update_hw_256(st, u1)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
update_hw_128l :: #force_inline proc "contextless" (st: ^State_HW, m0, m1: x86.__m128i) {
|
||||
s0_ := x86._mm_aesenc_si128(st.s7, x86._mm_xor_si128(st.s0, m0))
|
||||
s1_ := x86._mm_aesenc_si128(st.s0, st.s1)
|
||||
s2_ := x86._mm_aesenc_si128(st.s1, st.s2)
|
||||
s3_ := x86._mm_aesenc_si128(st.s2, st.s3)
|
||||
s4_ := x86._mm_aesenc_si128(st.s3, x86._mm_xor_si128(st.s4, m1))
|
||||
s5_ := x86._mm_aesenc_si128(st.s4, st.s5)
|
||||
s6_ := x86._mm_aesenc_si128(st.s5, st.s6)
|
||||
s7_ := x86._mm_aesenc_si128(st.s6, st.s7)
|
||||
st.s0, st.s1, st.s2, st.s3, st.s4, st.s5, st.s6, st.s7 = s0_, s1_, s2_, s3_, s4_, s5_, s6_, s7_
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
update_hw_256 :: #force_inline proc "contextless" (st: ^State_HW, m: x86.__m128i) {
|
||||
s0_ := x86._mm_aesenc_si128(st.s5, x86._mm_xor_si128(st.s0, m))
|
||||
s1_ := x86._mm_aesenc_si128(st.s0, st.s1)
|
||||
s2_ := x86._mm_aesenc_si128(st.s1, st.s2)
|
||||
s3_ := x86._mm_aesenc_si128(st.s2, st.s3)
|
||||
s4_ := x86._mm_aesenc_si128(st.s3, st.s4)
|
||||
s5_ := x86._mm_aesenc_si128(st.s4, st.s5)
|
||||
st.s0, st.s1, st.s2, st.s3, st.s4, st.s5 = s0_, s1_, s2_, s3_, s4_, s5_
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
absorb_hw_128l :: #force_inline proc "contextless" (st: ^State_HW, ai: []byte) {
|
||||
t0 := intrinsics.unaligned_load((^x86.__m128i)(&ai[0]))
|
||||
t1 := intrinsics.unaligned_load((^x86.__m128i)(&ai[16]))
|
||||
update_hw_128l(st, t0, t1)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
absorb_hw_256 :: #force_inline proc "contextless" (st: ^State_HW, ai: []byte) {
|
||||
m := intrinsics.unaligned_load((^x86.__m128i)(&ai[0]))
|
||||
update_hw_256(st, m)
|
||||
}
|
||||
|
||||
@(private, enable_target_feature = "sse2,aes")
|
||||
absorb_hw :: proc "contextless" (st: ^State_HW, aad: []byte) #no_bounds_check {
|
||||
ai, l := aad, len(aad)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
absorb_hw_128l(st, ai)
|
||||
ai = ai[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
absorb_hw_256(st, ai)
|
||||
|
||||
ai = ai[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Pad out the remainder with `0`s till it is rate sized.
|
||||
if l > 0 {
|
||||
tmp: [_RATE_MAX]byte // AAD is not confidential.
|
||||
copy(tmp[:], ai)
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
absorb_hw_128l(st, tmp[:])
|
||||
case _RATE_256:
|
||||
absorb_hw_256(st, tmp[:])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2", require_results)
|
||||
z_hw_128l :: #force_inline proc "contextless" (st: ^State_HW) -> (x86.__m128i, x86.__m128i) {
|
||||
z0 := x86._mm_xor_si128(
|
||||
st.s6,
|
||||
x86._mm_xor_si128(
|
||||
st.s1,
|
||||
x86._mm_and_si128(st.s2, st.s3),
|
||||
),
|
||||
)
|
||||
z1 := x86._mm_xor_si128(
|
||||
st.s2,
|
||||
x86._mm_xor_si128(
|
||||
st.s5,
|
||||
x86._mm_and_si128(st.s6, st.s7),
|
||||
),
|
||||
)
|
||||
return z0, z1
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2", require_results)
|
||||
z_hw_256 :: #force_inline proc "contextless" (st: ^State_HW) -> x86.__m128i {
|
||||
return x86._mm_xor_si128(
|
||||
st.s1,
|
||||
x86._mm_xor_si128(
|
||||
st.s4,
|
||||
x86._mm_xor_si128(
|
||||
st.s5,
|
||||
x86._mm_and_si128(st.s2, st.s3),
|
||||
),
|
||||
),
|
||||
)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
enc_hw_128l :: #force_inline proc "contextless" (st: ^State_HW, ci, xi: []byte) #no_bounds_check {
|
||||
z0, z1 := z_hw_128l(st)
|
||||
|
||||
t0 := intrinsics.unaligned_load((^x86.__m128i)(&xi[0]))
|
||||
t1 := intrinsics.unaligned_load((^x86.__m128i)(&xi[16]))
|
||||
update_hw_128l(st, t0, t1)
|
||||
|
||||
out0 := x86._mm_xor_si128(t0, z0)
|
||||
out1 := x86._mm_xor_si128(t1, z1)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&ci[0]), out0)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&ci[16]), out1)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
enc_hw_256 :: #force_inline proc "contextless" (st: ^State_HW, ci, xi: []byte) #no_bounds_check {
|
||||
z := z_hw_256(st)
|
||||
|
||||
xi_ := intrinsics.unaligned_load((^x86.__m128i)(raw_data(xi)))
|
||||
update_hw_256(st, xi_)
|
||||
|
||||
ci_ := x86._mm_xor_si128(xi_, z)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(raw_data(ci)), ci_)
|
||||
}
|
||||
|
||||
@(private, enable_target_feature = "sse2,aes")
|
||||
enc_hw :: proc "contextless" (st: ^State_HW, dst, src: []byte) #no_bounds_check {
|
||||
ci, xi, l := dst, src, len(src)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
enc_hw_128l(st, ci, xi)
|
||||
ci = ci[_RATE_128L:]
|
||||
xi = xi[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
enc_hw_256(st, ci, xi)
|
||||
ci = ci[_RATE_256:]
|
||||
xi = xi[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Pad out the remainder with `0`s till it is rate sized.
|
||||
if l > 0 {
|
||||
tmp: [_RATE_MAX]byte // Ciphertext is not confidential.
|
||||
copy(tmp[:], xi)
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
enc_hw_128l(st, tmp[:], tmp[:])
|
||||
case _RATE_256:
|
||||
enc_hw_256(st, tmp[:], tmp[:])
|
||||
}
|
||||
copy(ci, tmp[:l])
|
||||
}
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
dec_hw_128l :: #force_inline proc "contextless" (st: ^State_HW, xi, ci: []byte) #no_bounds_check {
|
||||
z0, z1 := z_hw_128l(st)
|
||||
|
||||
t0 := intrinsics.unaligned_load((^x86.__m128i)(&ci[0]))
|
||||
t1 := intrinsics.unaligned_load((^x86.__m128i)(&ci[16]))
|
||||
out0 := x86._mm_xor_si128(t0, z0)
|
||||
out1 := x86._mm_xor_si128(t1, z1)
|
||||
|
||||
update_hw_128l(st, out0, out1)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&xi[0]), out0)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&xi[16]), out1)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
dec_hw_256 :: #force_inline proc "contextless" (st: ^State_HW, xi, ci: []byte) #no_bounds_check {
|
||||
z := z_hw_256(st)
|
||||
|
||||
ci_ := intrinsics.unaligned_load((^x86.__m128i)(raw_data(ci)))
|
||||
xi_ := x86._mm_xor_si128(ci_, z)
|
||||
|
||||
update_hw_256(st, xi_)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(raw_data(xi)), xi_)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
dec_partial_hw_128l :: #force_inline proc "contextless" (st: ^State_HW, xn, cn: []byte) #no_bounds_check {
|
||||
tmp: [_RATE_128L]byte
|
||||
defer mem.zero_explicit(&tmp, size_of(tmp))
|
||||
|
||||
z0, z1 := z_hw_128l(st)
|
||||
copy(tmp[:], cn)
|
||||
|
||||
t0 := intrinsics.unaligned_load((^x86.__m128i)(&tmp[0]))
|
||||
t1 := intrinsics.unaligned_load((^x86.__m128i)(&tmp[16]))
|
||||
out0 := x86._mm_xor_si128(t0, z0)
|
||||
out1 := x86._mm_xor_si128(t1, z1)
|
||||
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tmp[0]), out0)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tmp[16]), out1)
|
||||
copy(xn, tmp[:])
|
||||
|
||||
for off := len(xn); off < _RATE_128L; off += 1 {
|
||||
tmp[off] = 0
|
||||
}
|
||||
out0 = intrinsics.unaligned_load((^x86.__m128i)(&tmp[0])) // v0
|
||||
out1 = intrinsics.unaligned_load((^x86.__m128i)(&tmp[16])) // v1
|
||||
update_hw_128l(st, out0, out1)
|
||||
}
|
||||
|
||||
@(private = "file", enable_target_feature = "sse2,aes")
|
||||
dec_partial_hw_256 :: #force_inline proc "contextless" (st: ^State_HW, xn, cn: []byte) #no_bounds_check {
|
||||
tmp: [_RATE_256]byte
|
||||
defer mem.zero_explicit(&tmp, size_of(tmp))
|
||||
|
||||
z := z_hw_256(st)
|
||||
copy(tmp[:], cn)
|
||||
|
||||
cn_ := intrinsics.unaligned_load((^x86.__m128i)(&tmp[0]))
|
||||
xn_ := x86._mm_xor_si128(cn_, z)
|
||||
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tmp[0]), xn_)
|
||||
copy(xn, tmp[:])
|
||||
|
||||
for off := len(xn); off < _RATE_256; off += 1 {
|
||||
tmp[off] = 0
|
||||
}
|
||||
xn_ = intrinsics.unaligned_load((^x86.__m128i)(&tmp[0]))
|
||||
update_hw_256(st, xn_)
|
||||
}
|
||||
|
||||
@(private, enable_target_feature = "sse2,aes")
|
||||
dec_hw :: proc "contextless" (st: ^State_HW, dst, src: []byte) #no_bounds_check {
|
||||
xi, ci, l := dst, src, len(src)
|
||||
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
for l >= _RATE_128L {
|
||||
dec_hw_128l(st, xi, ci)
|
||||
xi = xi[_RATE_128L:]
|
||||
ci = ci[_RATE_128L:]
|
||||
l -= _RATE_128L
|
||||
}
|
||||
case _RATE_256:
|
||||
for l >= _RATE_256 {
|
||||
dec_hw_256(st, xi, ci)
|
||||
xi = xi[_RATE_256:]
|
||||
ci = ci[_RATE_256:]
|
||||
l -= _RATE_256
|
||||
}
|
||||
}
|
||||
|
||||
// Process the remainder.
|
||||
if l > 0 {
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
dec_partial_hw_128l(st, xi, ci)
|
||||
case _RATE_256:
|
||||
dec_partial_hw_256(st, xi, ci)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@(private, enable_target_feature = "sse2,aes")
|
||||
finalize_hw :: proc "contextless" (st: ^State_HW, tag: []byte, ad_len, msg_len: int) {
|
||||
tmp: [16]byte
|
||||
endian.unchecked_put_u64le(tmp[0:], u64(ad_len) * 8)
|
||||
endian.unchecked_put_u64le(tmp[8:], u64(msg_len) * 8)
|
||||
|
||||
t := intrinsics.unaligned_load((^x86.__m128i)(&tmp[0]))
|
||||
|
||||
t0, t1: x86.__m128i = ---, ---
|
||||
switch st.rate {
|
||||
case _RATE_128L:
|
||||
t = x86._mm_xor_si128(st.s2, t)
|
||||
for _ in 0 ..< 7 {
|
||||
update_hw_128l(st, t, t)
|
||||
}
|
||||
|
||||
t0 = x86._mm_xor_si128(st.s0, st.s1)
|
||||
t0 = x86._mm_xor_si128(t0, st.s2)
|
||||
t0 = x86._mm_xor_si128(t0, st.s3)
|
||||
|
||||
t1 = x86._mm_xor_si128(st.s4, st.s5)
|
||||
t1 = x86._mm_xor_si128(t1, st.s6)
|
||||
if len(tag) == TAG_SIZE_256 {
|
||||
t1 = x86._mm_xor_si128(t1, st.s7)
|
||||
}
|
||||
case _RATE_256:
|
||||
t = x86._mm_xor_si128(st.s3, t)
|
||||
for _ in 0 ..< 7 {
|
||||
update_hw_256(st, t)
|
||||
}
|
||||
|
||||
t0 = x86._mm_xor_si128(st.s0, st.s1)
|
||||
t0 = x86._mm_xor_si128(t0, st.s2)
|
||||
|
||||
t1 = x86._mm_xor_si128(st.s3, st.s4)
|
||||
t1 = x86._mm_xor_si128(t1, st.s5)
|
||||
}
|
||||
switch len(tag) {
|
||||
case TAG_SIZE_128:
|
||||
t0 = x86._mm_xor_si128(t0, t1)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tag[0]), t0)
|
||||
case TAG_SIZE_256:
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tag[0]), t0)
|
||||
intrinsics.unaligned_store((^x86.__m128i)(&tag[16]), t1)
|
||||
}
|
||||
}
|
||||
|
||||
@(private)
|
||||
reset_state_hw :: proc "contextless" (st: ^State_HW) {
|
||||
mem.zero_explicit(st, size_of(st^))
|
||||
}
|
||||
Reference in New Issue
Block a user