Home GnuPG

Add x86 HW acceleration for GCM-SIV counter mode

Description

Add x86 HW acceleration for GCM-SIV counter mode

* cipher/cipher-gcm-siv.c (do_ctr_le32): Use bulk function if
available.
* cipher/cipher-internal.h (cipher_bulk_ops): Add 'ctr32le_enc'.
* cipher/rijndael-aesni.c (_gcry_aes_aesni_ctr32le_enc): New.
* cipher/rijndael-vaes-avx2-amd64.S
(_gcry_vaes_avx2_ctr32le_enc_amd64, .Lle_addd_*): New.
* cipher/rijndael-vaes.c (_gcry_vaes_avx2_ctr32le_enc_amd64)
(_gcry_aes_vaes_ctr32le_enc): New.
* cipher/rijndael.c (_gcry_aes_aesni_ctr32le_enc)
(_gcry_aes_vaes_ctr32le_enc): New prototypes.
(do_setkey): Add setup of 'bulk_ops->ctr32le_enc' for AES-NI and
VAES.
* tests/basic.c (check_gcm_siv_cipher): Add large test-vector for
bulk ops testing.

Counter mode in GCM-SIV is little-endian on first 4 bytes of
of counter block, unlike regular CTR mode which works on
big-endian full block.

Benchmark on AMD Ryzen 7 5800X:

Before:
AES | nanosecs/byte mebibytes/sec cycles/byte auto Mhz

 GCM-SIV enc |      1.00 ns/B     953.2 MiB/s      4.85 c/B      4850
 GCM-SIV dec |      1.01 ns/B     940.1 MiB/s      4.92 c/B      4850
GCM-SIV auth |     0.118 ns/B      8051 MiB/s     0.575 c/B      4850

After (~6x faster):
AES | nanosecs/byte mebibytes/sec cycles/byte auto Mhz

 GCM-SIV enc |     0.150 ns/B      6367 MiB/s     0.727 c/B      4850
 GCM-SIV dec |     0.161 ns/B      5909 MiB/s     0.783 c/B      4850
GCM-SIV auth |     0.118 ns/B      8051 MiB/s     0.574 c/B      4850
  • GnuPG-bug-id: T4485
  • Signed-off-by: Jussi Kivilinna <jussi.kivilinna@iki.fi>

Details

Provenance
jukiviliAuthored on Aug 13 2021, 3:20 PM
Parents
rC1b8994c4ecf2: Add AES-GCM-SIV mode (RFC 8452)
Branches
Unknown
Tags
Unknown
Tasks
T4485: Add AEAD mode AES-GCM-SIV to libgcrypt (RFC 8452)