On Tue, 2018-01-09 at 09:17 +0100, Nikos Mavrogiannopoulos wrote:
> > > in ctr_crypt contribudes quite a few cycles per byte. It would be
> > > faster
> > > to use an always word-aligned area, and do the copying and
> > > incrementing
> > > using word operations (and final byteswap when running on a
> > > little-endian platform), and with no intermediate stores.
> >
> > I've tried this, with special code for block size 16. (Without any
> > assembly, but using __builtin_bswap64). Pushed to the ctr-opt
> > branch.
> > Gives a nice speedup. On my machine:
>
> I see a quite large speedup on my x86_64 too on CTR. Note however
> that GCM performance is not affected.
To follow up on this, gcm would get an 8% (on my system) speedup by
switching gcm_crypt() with ctr_crypt(). With that change as is however,
the 32-bit counter is replaced with an "unlimited" counter. Wouldn't
introducing an assert on decrypt and encrypt length be sufficient to
share that code?
regards,
Nikos
diff --git a/gcm.c b/gcm.c
index 0a2102f1..1b1c077a 100644
--- a/gcm.c
+++ b/gcm.c
@@ -51,6 +51,7 @@
#include "memxor.h"
#include "nettle-internal.h"
#include "macros.h"
+#include "ctr.h"
#define GHASH_POLYNOMIAL 0xE1UL
@@ -434,43 +435,6 @@ gcm_update(struct gcm_ctx *ctx, const struct gcm_key *key,
ctx->auth_size += length;
}
-static void
-gcm_crypt(struct gcm_ctx *ctx, const void *cipher, nettle_cipher_func *f,
- size_t length, uint8_t *dst, const uint8_t *src)
-{
- uint8_t buffer[GCM_BLOCK_SIZE];
-
- if (src != dst)
- {
- for (; length >= GCM_BLOCK_SIZE;
- (length -= GCM_BLOCK_SIZE,
- src += GCM_BLOCK_SIZE, dst += GCM_BLOCK_SIZE))
- {
- f (cipher, GCM_BLOCK_SIZE, dst, ctx->ctr.b);
- memxor (dst, src, GCM_BLOCK_SIZE);
- INC32 (ctx->ctr);
- }
- }
- else
- {
- for (; length >= GCM_BLOCK_SIZE;
- (length -= GCM_BLOCK_SIZE,
- src += GCM_BLOCK_SIZE, dst += GCM_BLOCK_SIZE))
- {
- f (cipher, GCM_BLOCK_SIZE, buffer, ctx->ctr.b);
- memxor (dst, buffer, GCM_BLOCK_SIZE);
- INC32 (ctx->ctr);
- }
- }
- if (length > 0)
- {
- /* A final partial block */
- f (cipher, GCM_BLOCK_SIZE, buffer, ctx->ctr.b);
- memxor3 (dst, src, buffer, length);
- INC32 (ctx->ctr);
- }
-}
-
void
gcm_encrypt (struct gcm_ctx *ctx, const struct gcm_key *key,
const void *cipher, nettle_cipher_func *f,
@@ -478,7 +442,7 @@ gcm_encrypt (struct gcm_ctx *ctx, const struct gcm_key *key,
{
assert(ctx->data_size % GCM_BLOCK_SIZE == 0);
- gcm_crypt(ctx, cipher, f, length, dst, src);
+ ctr_crypt(cipher, f, GCM_BLOCK_SIZE, ctx->ctr.b, length, dst, src);
gcm_hash(key, &ctx->x, length, dst);
ctx->data_size += length;
@@ -492,7 +456,7 @@ gcm_decrypt(struct gcm_ctx *ctx, const struct gcm_key *key,
assert(ctx->data_size % GCM_BLOCK_SIZE == 0);
gcm_hash(key, &ctx->x, length, src);
- gcm_crypt(ctx, cipher, f, length, dst, src);
+ ctr_crypt(cipher, f, GCM_BLOCK_SIZE, ctx->ctr.b, length, dst, src);
ctx->data_size += length;
}
_______________________________________________
nettle-bugs mailing list
[email protected]
http://lists.lysator.liu.se/mailman/listinfo/nettle-bugs
