svn commit: r314335 - stable/10/sys/crypto/sha2

[Colin Percival]

On 02/27/17 06:01, Ed Schouten wrote:
> Something interesting that I noticed some time ago when comparing the
> various SHA-{256,512} implementations: there is no need to store the
> entire extended message in W. During every iteration of this loop,
> RNDr() and MSCH() never go more than 16 elements back.
> 
> Say, if you were to modify MSCH() to something like this:
> 
>> +#define MSCH(W, ii)                         \
>> +       W[ii] += s1(W[(ii + 14) % 16]) + W[(ii + 9) % 16] + s0(W[(ii + 1)) % 16])
> 
> Then it will compute the next chunk of the extended message in-place.
> RNDr() must then be adjusted to use W[i] instead of W[i + ii], of
> course. W then only needs to hold 16 elements instead of 64 or 80.

I tried this, and it was slower.  The larger array avoids write-after-read
accesses and results in better code being emitted due to more flexible
instruction scheduling.

-- 
Colin Percival
Security Officer Emeritus, FreeBSD | The power to serve
Founder, Tarsnap | www.tarsnap.com | Online backups for the truly paranoid