3 ms·
This is kind of hard to avoid without hand-coded assembly or careful use of vector intrinsics. The core of chacha20 is a 4x4 matrix, which would need 16 registe
by cesarb 7y ago
This is kind of hard to avoid without hand-coded assembly or careful use of vector intrinsics. The core of chacha20 is a 4x4 matrix, which would need 16 registers to hold without spilling (plus a few more for temporary use during the calculations). Both 64-bit x86 and 32-bit ARM have only 15 or 16 general-purpose registers.
- a1369209993 7y agoFWIW x64 effectively has 32 GPRs worth of 32-bit registers, which is what chacha20 needs. You'd need to access them as something like: add eax r8d rol r8 32 add edx r8d though, so several are useless due to clobbering, and you'd need to schedule things rather weirdly. Also, where did you get the RNG state from, if you don't trust memory to be read-what-where-proof?
- dependenttypes 7y agoYou could also use the SSE/AVX registers.
- a1369209993 7y agoProbably true (I think all x64 hardware includes SSE at least), but they did imply they were trying to use just the scalar instructions. (They also said no hand-assembly, but something like: register uint64_t ra,rd,... ra += 0xFFFFFFFF&r8 rd += r8 >> 32 should accomplish much the same thing given a resonably well-developed compiler.)