-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathdeoxys_amd64.s
More file actions
426 lines (353 loc) · 7.87 KB
/
Copy pathdeoxys_amd64.s
File metadata and controls
426 lines (353 loc) · 7.87 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
// Deoxys-BC-256 and ButterKnife assembly optimizations for amd64
// Uses Intel AES-NI instructions for hardware acceleration
#include "textflag.h"
// func deoxysBC256EncryptASM(state *Block, stk *[15]Block)
// Encrypts a block using Deoxys-BC-256 with precomputed subtweakeys.
// Structure: XOR STK[0], then 13 AESENC rounds, then AESENCLAST
TEXT ·deoxysBC256EncryptASM(SB),NOSPLIT,$0
MOVQ state+0(FP), AX
MOVQ stk+8(FP), BX
// Load state into XMM0
MOVOU (AX), X0
// Initial whitening: XOR with STK[0]
MOVOU (BX), X1
PXOR X1, X0
// Rounds 1-13: full AES rounds with STK[1-13]
MOVOU 16(BX), X1
AESENC X1, X0
MOVOU 32(BX), X1
AESENC X1, X0
MOVOU 48(BX), X1
AESENC X1, X0
MOVOU 64(BX), X1
AESENC X1, X0
MOVOU 80(BX), X1
AESENC X1, X0
MOVOU 96(BX), X1
AESENC X1, X0
MOVOU 112(BX), X1
AESENC X1, X0
MOVOU 128(BX), X1
AESENC X1, X0
MOVOU 144(BX), X1
AESENC X1, X0
MOVOU 160(BX), X1
AESENC X1, X0
MOVOU 176(BX), X1
AESENC X1, X0
MOVOU 192(BX), X1
AESENC X1, X0
MOVOU 208(BX), X1
AESENC X1, X0
// Final round: SubBytes, ShiftRows, XOR STK[14] (no MixColumns)
MOVOU 224(BX), X1
AESENCLAST X1, X0
// Store result
MOVOU X0, (AX)
RET
// func deoxysBC256DecryptASM(state *Block, stk *[15]Block)
// Decrypts a block using Deoxys-BC-256.
// Note: This requires the STK to have InvMixColumns applied to middle keys.
// We use the inverse round keys stored at offset 240 (after the 15 STK blocks).
TEXT ·deoxysBC256DecryptASM(SB),NOSPLIT,$0
MOVQ state+0(FP), AX
MOVQ stk+8(FP), BX
// Load state into XMM0
MOVOU (AX), X0
// XOR with STK[14]
MOVOU 224(BX), X1
PXOR X1, X0
// Rounds 13-1: inverse AES rounds with InvMixColumns(STK[13-1])
// The inverse keys are stored at offset 240+16*i
MOVOU 448(BX), X1 // InvSTK[13] at 240 + 13*16 = 448
AESDEC X1, X0
MOVOU 432(BX), X1 // InvSTK[12]
AESDEC X1, X0
MOVOU 416(BX), X1 // InvSTK[11]
AESDEC X1, X0
MOVOU 400(BX), X1 // InvSTK[10]
AESDEC X1, X0
MOVOU 384(BX), X1 // InvSTK[9]
AESDEC X1, X0
MOVOU 368(BX), X1 // InvSTK[8]
AESDEC X1, X0
MOVOU 352(BX), X1 // InvSTK[7]
AESDEC X1, X0
MOVOU 336(BX), X1 // InvSTK[6]
AESDEC X1, X0
MOVOU 320(BX), X1 // InvSTK[5]
AESDEC X1, X0
MOVOU 304(BX), X1 // InvSTK[4]
AESDEC X1, X0
MOVOU 288(BX), X1 // InvSTK[3]
AESDEC X1, X0
MOVOU 272(BX), X1 // InvSTK[2]
AESDEC X1, X0
MOVOU 256(BX), X1 // InvSTK[1]
AESDEC X1, X0
// Final round: InvSubBytes, InvShiftRows, XOR STK[0]
MOVOU (BX), X1
AESDECLAST X1, X0
// Store result
MOVOU X0, (AX)
RET
// func butterKnifePreForkASM(state *Block, stk *[16]Block)
// Performs the 7 pre-fork rounds of ButterKnife.
// Each round: XOR subtweakey, SubBytes, ShiftRows, MixColumns
TEXT ·butterKnifePreForkASM(SB),NOSPLIT,$0
MOVQ state+0(FP), AX
MOVQ stk+8(FP), BX
// Load state
MOVOU (AX), X0
// Round 0: XOR STK[0], then SubBytes, ShiftRows, MixColumns
MOVOU (BX), X1
PXOR X1, X0
// Use AESENC with zero key for SubBytes+ShiftRows+MixColumns, then XOR will be done next round
// Actually, ButterKnife does: AddRoundTweakey first, then SubBytes, ShiftRows, MixColumns
// So: XOR key, SubBytes, ShiftRows, MixColumns
// AESENC does: SubBytes, ShiftRows, MixColumns, XOR key
// These are different! We need to do the XOR first.
// For ButterKnife round structure (KeyFirst):
// We can use: PXOR key, then AESENC with zero
PXOR X1, X1 // Zero X1
AESENC X1, X0
// Round 1
MOVOU 16(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 2
MOVOU 32(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 3
MOVOU 48(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 4
MOVOU 64(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 5
MOVOU 80(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 6
MOVOU 96(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Store result
MOVOU X0, (AX)
RET
// func butterKnifeBranchASM(state *Block, forkState *Block, stk *[9]Block)
// Performs one branch of ButterKnife: 8 rounds + final AddRoundTweakey + feed-forward.
// stk contains subtweakeys for rounds 7-14 (indices 0-7) and round 15 (index 8).
TEXT ·butterKnifeBranchASM(SB),NOSPLIT,$0
MOVQ state+0(FP), AX
MOVQ forkState+8(FP), CX
MOVQ stk+16(FP), BX
// Load state and fork state
MOVOU (AX), X0
MOVOU (CX), X2 // Keep fork state for feed-forward
// Rounds 7-14 (8 rounds): XOR key, SubBytes, ShiftRows, MixColumns
// Round 7 (index 0)
MOVOU (BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 8 (index 1)
MOVOU 16(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 9 (index 2)
MOVOU 32(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 10 (index 3)
MOVOU 48(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 11 (index 4)
MOVOU 64(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 12 (index 5)
MOVOU 80(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 13 (index 6)
MOVOU 96(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Round 14 (index 7)
MOVOU 112(BX), X1
PXOR X1, X0
PXOR X1, X1
AESENC X1, X0
// Final AddRoundTweakey (round 15, index 8)
MOVOU 128(BX), X1
PXOR X1, X0
// Feed-forward: XOR with fork state
PXOR X2, X0
// Store result
MOVOU X0, (AX)
RET
// func butterKnife4BranchesASM(branches *Block4, forkState *Block, stk *[4][9]Block)
// Processes 4 ButterKnife branches in parallel using AVX registers.
// branches: 4 x 16-byte blocks to process
// forkState: the fork state to XOR at the end
// stk: 4 sets of 9 subtweakeys (rounds 7-15 for each branch)
TEXT ·butterKnife4BranchesASM(SB),NOSPLIT,$0
MOVQ branches+0(FP), AX
MOVQ forkState+8(FP), CX
MOVQ stk+16(FP), BX
// Load 4 branch states
MOVOU (AX), X0
MOVOU 16(AX), X1
MOVOU 32(AX), X2
MOVOU 48(AX), X3
// Load fork state (same for all branches)
MOVOU (CX), X8
// Round 7 (index 0 in each branch's STK)
// Branch 0: offset 0, Branch 1: offset 144, Branch 2: offset 288, Branch 3: offset 432
MOVOU (BX), X4
PXOR X4, X0
MOVOU 144(BX), X4
PXOR X4, X1
MOVOU 288(BX), X4
PXOR X4, X2
MOVOU 432(BX), X4
PXOR X4, X3
PXOR X4, X4 // Zero
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 8 (index 1)
MOVOU 16(BX), X4
PXOR X4, X0
MOVOU 160(BX), X4
PXOR X4, X1
MOVOU 304(BX), X4
PXOR X4, X2
MOVOU 448(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 9 (index 2)
MOVOU 32(BX), X4
PXOR X4, X0
MOVOU 176(BX), X4
PXOR X4, X1
MOVOU 320(BX), X4
PXOR X4, X2
MOVOU 464(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 10 (index 3)
MOVOU 48(BX), X4
PXOR X4, X0
MOVOU 192(BX), X4
PXOR X4, X1
MOVOU 336(BX), X4
PXOR X4, X2
MOVOU 480(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 11 (index 4)
MOVOU 64(BX), X4
PXOR X4, X0
MOVOU 208(BX), X4
PXOR X4, X1
MOVOU 352(BX), X4
PXOR X4, X2
MOVOU 496(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 12 (index 5)
MOVOU 80(BX), X4
PXOR X4, X0
MOVOU 224(BX), X4
PXOR X4, X1
MOVOU 368(BX), X4
PXOR X4, X2
MOVOU 512(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 13 (index 6)
MOVOU 96(BX), X4
PXOR X4, X0
MOVOU 240(BX), X4
PXOR X4, X1
MOVOU 384(BX), X4
PXOR X4, X2
MOVOU 528(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Round 14 (index 7)
MOVOU 112(BX), X4
PXOR X4, X0
MOVOU 256(BX), X4
PXOR X4, X1
MOVOU 400(BX), X4
PXOR X4, X2
MOVOU 544(BX), X4
PXOR X4, X3
PXOR X4, X4
AESENC X4, X0
AESENC X4, X1
AESENC X4, X2
AESENC X4, X3
// Final AddRoundTweakey (round 15, index 8) and feed-forward
MOVOU 128(BX), X4
PXOR X4, X0
PXOR X8, X0
MOVOU 272(BX), X4
PXOR X4, X1
PXOR X8, X1
MOVOU 416(BX), X4
PXOR X4, X2
PXOR X8, X2
MOVOU 560(BX), X4
PXOR X4, X3
PXOR X8, X3
// Store results
MOVOU X0, (AX)
MOVOU X1, 16(AX)
MOVOU X2, 32(AX)
MOVOU X3, 48(AX)
RET