Frank Denis 9d179a98f6 Make Poly1305 faster by leveraging @addWithOverflow/@subWithOverflow (#15815) ...

These operations are constant-time on most, if not all currently
supported architectures. However, even if they are not, this is not
a big deal in the case on Poly1305, as the key is added at the end.

The final addition remains protected.

SalsaPoly and ChaChaPoly do encrypt-then-mac, so side channels would
not leak anything about the plaintext anyway.

* Apple Silicon (M1)

Before: 2048 MiB/s
After : 2823 MiB/s

* AMD Ryzen 7

Before: 3165 MiB/s
After : 4774 MiB/s

2023-05-23 09:55:45 +02:00

6.5 KiB

Raw Blame History

View Raw