* xts.c (xts_shift): Arrange with a single write to u64[1].
* cmac.c (block_mulx): Rewrite to work in the same way as
xts_shift, with 64-bit operations. XTS and CMAC use opposite
endianness, but otherwise, these two functions are identical.

The structs are named xts_aes*_key, not xts_aes*_ctx.

Simo Sorce authored Mar 20, 2019 and Niels Möller committed Mar 24, 2019

This creates two implementations of xts_shift, one for little endian and
one for big endian. This way we avoid copies to additional variables and
inefficient byteswapping on platforms that do not have dedicated
instructions.

Signed-off-by: Simo Sorce <simo@redhat.com>

Simo Sorce authored Mar 19, 2019 and Niels Möller committed Mar 24, 2019

This avoids copying and may be somewhat more readable without the need
for so much explanation.

Signed-off-by: Simo Sorce <simo@redhat.com>

Simo Sorce authored Oct 04, 2018 and Niels Möller committed Mar 24, 2019

XEX encryption mode with tweak and ciphertext stealing (XTS) is
standardized in IEEE 1619 and generally used for storage devices.

Signed-off-by: Simo Sorce <simo@redhat.com>

Yuriy M. Kaminskiy authored Jan 02, 2019 and Niels Möller committed Jan 19, 2019

On BCM2837B0 (Cortex-A53) @1.4GHz (Raspberry Pi 3B+),
Before:
`gnutls-cli --benchmark-ciphers`
       CHACHA20-POLY1305 (16384) 51.54 MB/sec
`gnutls-cli --benchmark-tls-ciphers`:
       ECDHE_RSA_CHACHA20_POLY1305 (payload 1400)  21.31 MB/sec
       ECDHE_RSA_CHACHA20_POLY1305 (payload 15360)  24.60 MB/sec
`nettle-benchmark`
		 chacha     encrypt   71.90
		 chacha     decrypt   71.89
	chacha_poly1305     encrypt   48.17
	chacha_poly1305     decrypt   48.17
	chacha_poly1305      update  146.03

After:
`gnutls-cli --benchmark-ciphers`
       CHACHA20-POLY1305 (16384) 68.44 MB/sec
`gnutls-cli --benchmark-tls-ciphers`:
       ECDHE_RSA_CHACHA20_POLY1305 (payload 1400) 27.25 MB/sec
       ECDHE_RSA_CHACHA20_POLY1305 (payload 15360) 32.41 MB/sec
`nettle-benchmark`
		 chacha     encrypt  106.00
		 chacha     decrypt  105.94
	chacha_poly1305     encrypt   65.94
	chacha_poly1305     decrypt   65.96
	chacha_poly1305      update  175.24

Nikos Mavrogiannopoulos authored Jan 02, 2019 and Niels Möller committed Jan 12, 2019

Signed-off-by: Nikos Mavrogiannopoulos <nmav@redhat.com>

(cherry picked from commit 73d3c6d5)