GitLab

* xts.c (xts_shift): Arrange with a single write to u64[1].
* cmac.c (block_mulx): Rewrite to work in the same way as
xts_shift, with 64-bit operations. XTS and CMAC use opposite
endianness, but otherwise, these two functions are identical.

The structs are named xts_aes*_key, not xts_aes*_ctx.

This creates two implementations of xts_shift, one for little endian and
one for big endian. This way we avoid copies to additional variables and
inefficient byteswapping on platforms that do not have dedicated
instructions.
Signed-off-by: Simo Sorce <simo@redhat.com>

This avoids copying and may be somewhat more readable without the need
for so much explanation.
Signed-off-by: Simo Sorce <simo@redhat.com>

XEX encryption mode with tweak and ciphertext stealing (XTS) is
standardized in IEEE 1619 and generally used for storage devices.
Signed-off-by: Simo Sorce <simo@redhat.com>

On BCM2837B0 (Cortex-A53) @1.4GHz (Raspberry Pi 3B+),
Before:
`gnutls-cli --benchmark-ciphers`
       CHACHA20-POLY1305 (16384) 51.54 MB/sec
`gnutls-cli --benchmark-tls-ciphers`:
       ECDHE_RSA_CHACHA20_POLY1305 (payload 1400)  21.31 MB/sec
       ECDHE_RSA_CHACHA20_POLY1305 (payload 15360)  24.60 MB/sec
`nettle-benchmark`
		 chacha     encrypt   71.90
		 chacha     decrypt   71.89
	chacha_poly1305     encrypt   48.17
	chacha_poly1305     decrypt   48.17
	chacha_poly1305      update  146.03

After:
`gnutls-cli --benchmark-ciphers`
       CHACHA20-POLY1305 (16384) 68.44 MB/sec
`gnutls-cli --benchmark-tls-ciphers`:
       ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 27.25 MB/sec
       ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 32.41 MB/sec
`nettle-benchmark`
		 chacha     encrypt  106.00
		 chacha     decrypt  105.94
	chacha_poly1305     encrypt   65.94
	chacha_poly1305     decrypt   65.96
	chacha_poly1305      update  175.24

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

(cherry picked from commit 73d3c6d5)