From 22f9fa6e06305f85b45cf23fc68145d789633641 Mon Sep 17 00:00:00 2001 From: Andy Polyakov Date: Mon, 5 Jun 2017 11:07:55 +0200 Subject: [PATCH] sha/keccak1600.c: reduce temporary storage utilization even futher. Reviewed-by: Rich Salz --- crypto/sha/keccak1600.c | 93 ++++++++++++++++++++--------------------- 1 file changed, 46 insertions(+), 47 deletions(-) diff --git a/crypto/sha/keccak1600.c b/crypto/sha/keccak1600.c index 827affbad3..af24a5d2ed 100644 --- a/crypto/sha/keccak1600.c +++ b/crypto/sha/keccak1600.c @@ -343,9 +343,9 @@ void KeccakF1600(uint64_t A[5][5]) #elif defined(KECCAK_1X_ALT) /* - * This is variant of above KECCAK_1X that presses temporary storage - * even further, but at cost of more write references to A[5][5]. - * It's less suitable if A[5][5] is memory bound, but better if it's + * This is variant of above KECCAK_1X that reduces requirement for + * temporary storage even further, but at cost of more updates to A[][]. + * It's less suitable if A[][] is memory bound, but better if it's * register bound. */ @@ -361,40 +361,41 @@ static void Round(uint64_t A[5][5], size_t i) C[3] = A[0][3] ^ A[1][3] ^ A[2][3] ^ A[3][3] ^ A[4][3]; C[4] = A[0][4] ^ A[1][4] ^ A[2][4] ^ A[3][4] ^ A[4][4]; - D[0] = ROL64(C[1], 1) ^ C[4]; - A[0][0] ^= D[0]; - A[1][0] ^= D[0]; - A[2][0] ^= D[0]; - A[3][0] ^= D[0]; - A[4][0] ^= D[0]; + D[1] = C[0] ^ ROL64(C[2], 1); + D[2] = C[1] ^ ROL64(C[3], 1); + D[3] = C[2] ^= ROL64(C[4], 1); + D[4] = C[3] ^= ROL64(C[0], 1); + D[0] = C[4] ^= ROL64(C[1], 1); - D[1] = ROL64(C[2], 1) ^ C[0]; A[0][1] ^= D[1]; A[1][1] ^= D[1]; A[2][1] ^= D[1]; A[3][1] ^= D[1]; A[4][1] ^= D[1]; - D[2] = ROL64(C[3], 1) ^ C[1]; A[0][2] ^= D[2]; A[1][2] ^= D[2]; A[2][2] ^= D[2]; A[3][2] ^= D[2]; A[4][2] ^= D[2]; - D[3] = ROL64(C[4], 1) ^ C[2]; - A[0][3] ^= D[3]; - A[1][3] ^= D[3]; - A[2][3] ^= D[3]; - A[3][3] ^= D[3]; - A[4][3] ^= D[3]; + A[0][3] ^= C[2]; + A[1][3] ^= C[2]; + A[2][3] ^= C[2]; + A[3][3] ^= C[2]; + A[4][3] ^= C[2]; - D[4] = ROL64(C[0], 1) ^ C[3]; - A[0][4] ^= D[4]; - A[1][4] ^= D[4]; - A[2][4] ^= D[4]; - A[3][4] ^= D[4]; - A[4][4] ^= D[4]; + A[0][4] ^= C[3]; + A[1][4] ^= C[3]; + A[2][4] ^= C[3]; + A[3][4] ^= C[3]; + A[4][4] ^= C[3]; + + A[0][0] ^= C[4]; + A[1][0] ^= C[4]; + A[2][0] ^= C[4]; + A[3][0] ^= C[4]; + A[4][0] ^= C[4]; C[1] = A[0][1]; C[2] = A[0][2]; @@ -433,46 +434,44 @@ static void Round(uint64_t A[5][5], size_t i) C[0] = A[0][0]; C[1] = A[1][0]; - C[2] = A[2][0]; - C[3] = A[3][0]; - C[4] = A[4][0]; - D[0] = A[0][1]; D[1] = A[1][1]; - D[2] = A[2][1]; - D[3] = A[3][1]; - D[4] = A[4][1]; A[0][0] ^= (~A[0][1] & A[0][2]); A[1][0] ^= (~A[1][1] & A[1][2]); - A[2][0] ^= (~A[2][1] & A[2][2]); - A[3][0] ^= (~A[3][1] & A[3][2]); - A[4][0] ^= (~A[4][1] & A[4][2]); - A[0][1] ^= (~A[0][2] & A[0][3]); A[1][1] ^= (~A[1][2] & A[1][3]); - A[2][1] ^= (~A[2][2] & A[2][3]); - A[3][1] ^= (~A[3][2] & A[3][3]); - A[4][1] ^= (~A[4][2] & A[4][3]); - A[0][2] ^= (~A[0][3] & A[0][4]); A[1][2] ^= (~A[1][3] & A[1][4]); - A[2][2] ^= (~A[2][3] & A[2][4]); - A[3][2] ^= (~A[3][3] & A[3][4]); - A[4][2] ^= (~A[4][3] & A[4][4]); - A[0][3] ^= (~A[0][4] & C[0]); A[1][3] ^= (~A[1][4] & C[1]); - A[2][3] ^= (~A[2][4] & C[2]); - A[3][3] ^= (~A[3][4] & C[3]); - A[4][3] ^= (~A[4][4] & C[4]); - A[0][4] ^= (~C[0] & D[0]); A[1][4] ^= (~C[1] & D[1]); + + C[2] = A[2][0]; + C[3] = A[3][0]; + D[2] = A[2][1]; + D[3] = A[3][1]; + + A[2][0] ^= (~A[2][1] & A[2][2]); + A[3][0] ^= (~A[3][1] & A[3][2]); + A[2][1] ^= (~A[2][2] & A[2][3]); + A[3][1] ^= (~A[3][2] & A[3][3]); + A[2][2] ^= (~A[2][3] & A[2][4]); + A[3][2] ^= (~A[3][3] & A[3][4]); + A[2][3] ^= (~A[2][4] & C[2]); + A[3][3] ^= (~A[3][4] & C[3]); A[2][4] ^= (~C[2] & D[2]); A[3][4] ^= (~C[3] & D[3]); - A[4][4] ^= (~C[4] & D[4]); + C[4] = A[4][0]; + D[4] = A[4][1]; + + A[4][0] ^= (~A[4][1] & A[4][2]); + A[4][1] ^= (~A[4][2] & A[4][3]); + A[4][2] ^= (~A[4][3] & A[4][4]); + A[4][3] ^= (~A[4][4] & C[4]); + A[4][4] ^= (~C[4] & D[4]); A[0][0] ^= iotas[i]; } -- 2.25.1