"Eric Biggers" <ebiggers@xxxxxxxxxx> wrote:
> Instead of loading the message words into both MSG and \m0 and then
> adding the round constants to MSG, load the message words into \m0 and
> the round constants into MSG and then add \m0 to MSG. This shortens the
> source code slightly. It changes the instructions slightly, but it
> doesn't affect binary code size and doesn't seem to affect performance.
At last the final change: write the macro straightforward and SIMPLE,
closely matching NIST.FIPS.180-4.pdf and their order of operations.
@@ ...
+.macro sha256 m0 :req, m1 :req, m2 :req, m3 :req
+.if \@ < 4
+ movdqu \@*16(DATA_PTR), \m0
+ pshufb SHUF_MASK, \m0 # \m0 = {w(\@*16), w(\@*16+1), w(\@*16+2), w(\@*16+3)}
+.else
+ # \m0 = {w(\@*16-16), w(\@*16-15), w(\@*16-14), w(\@*16-13)}
+ # \m1 = {w(\@*16-12), w(\@*16-11), w(\@*16-10), w(\@*16-9)}
+ # \m2 = {w(\@*16-8), w(\@*16-7), w(\@*16-6), w(\@*16-5)}
+ # \m3 = {w(\@*16-4), w(\@*16-3), w(\@*16-2), w(\@*16-1)}
+ sha256msg1 \m1, \m0
+ movdqa \m3, TMP
+ palignr $4, \m2, TMP
+ paddd TMP, \m0
+ sha256msg2 \m3, \m0 # \m0 = {w(\@*16), w(\@*16+1), w(\@*16+2), w(\@*16+3)}
+.endif
+ movdqa (\@-8)*16(SHA256CONSTANTS), MSG
+ paddd \m0, MSG
+ sha256rnds2 STATE0, STATE1 # STATE1 = {f', e', b', a'}
+ punpckhqdq MSG, MSG
+ sha256rnds2 STATE1, STATE0 # STATE0 = {f", e", b", a"},
+ # STATE1 = {h", g", d", c"}
+.endm
JFTR: you may simplify this further using .altmacro and generate \m0 to \m3
as MSG%(4-\@&3), MSG%(5-\@&3), MSG%(6-\@&3) and MSG%(7-\@&3) within
the macro, thus getting rid of its 4 arguments.
@@ ...
+.rept 4 # 4*4*4 rounds
+ sha256 MSG0, MSG1, MSG2, MSG3
+ sha256 MSG1, MSG2, MSG3, MSG0
+ sha256 MSG2, MSG3, MSG0, MSG1
+ sha256 MSG3, MSG0, MSG1, MSG2
+.endr
Now that all code written by Tim Chen and Sean Gulley is gone,
remove their copyright notice and insert your and my name instead.
regards
Stefan
PS: see <https://skanthak.homepage.t-online.de/fips-180.html>
(which I still polish) not just for this implementation.
PPS: if MASM had a counter like \@, I'd used it there.
