Hey, On Thu, Feb 2, 2017 at 7:47 AM, Eric Biggers <ebiggers3@xxxxxxxxx> wrote: > I'm wondering whether it has to be that way, especially since it seems to most > commonly be used on very small input buffers, e.g. 8 or 16-byte blocks. Note that popular stream ciphers like chacha or salsa wind up XORing much longer blocks -- 64 bytes. Likewise, CTR mode tends to XOR using the block size as well. Not sure whether this is directly relavent for the decision making here, but I thought I'd mention it just in case. The XOR for this case should be _fast_, and preferably inlineable. Jason
