open-quantum-safe / liboqs / 40546526454

79%

Build Type

push

github

Committed by web-flow

Commit Message

Interleave four AES blocks in the AES-NI and ARMv8 ECB and CTR paths (#2594)

* Interleave four blocks in the AES-NI and ARMv8 ECB paths

The ECB encryption loops of the AES-NI and ARMv8 backends processed one
block at a time, so the latency of each AESENC (or AESE+AESMC) chain was
fully exposed. Process four blocks at a time with the four round chains
interleaved, as the AES-NI CTR paths already do, and fall back to one
block at a time for the remainder. AES-NI reuses its existing four-block
functions for AES-128 and AES-256 and gains one for AES-192; ARMv8 gains
four-block functions for all three key sizes.

test_aes now runs the four-block SP 800-38A ECB vectors for all three
key sizes through the schedule and one-shot APIs at 64 and 80 bytes, so
that a full four-block group and a one-block tail are checked on every
backend.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>

* Avoid undefined behaviour in the AES CTR counter byte-swap macro

BE_TO_UINT32 shifted a uint8_t, promoted to int, left by 24 bits. When
the top bit of that byte is set the result does not fit in an int, which
is undefined behaviour; UBSan reports it for any 16-byte IV whose byte
12 is 0x80 or above. Cast each byte to uint32_t before shifting.

The macro is used by the ARMv8 CTR paths. The copy in aes256_ni.c is
unused but is kept identical to the other two.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Douglas Stebila <dstebila@uwaterloo.ca>

* Test every multi-block ECB length and in-place encryption

Extend the SP 800-38A ECB test to nine blocks, so that a backend's
four-block loop runs zero, one and two times against every tail length
of zero to three blocks, rather than only the 64- and 80-byte cases.
Each length is also encrypted in place, which FrodoKEM relies on when it
expands its public matrix, and every call is checked for writes past the
requested length. Document in aes.h th... (continued)

Coverage Stats

12 of 58 new or added lines in 3 files covered. (20.69%)

17 existing lines in 13 files now uncovered.

186422 of 230058 relevant lines covered (81.03%)

4107004.05 hits per line