Implementation:
===============
The encrypt/decrypt code is based on an x86 implementation I did a while
ago which I never published. This unpublished implementation does
include an assembler based key schedule and precomputed tables. For
simplicity and best acceptance, however, I took Gladman's in-kernel code
for table generation and key schedule for the kernel port of my
assembler code and modified this code to produce the key schedule as
required by my assembler implementation. File locations and Kconfig are
kept similar to the i586 AES assembler implementation.
It may seem a little bit strange to use 32 bit I/O and registers in the
assembler implementation but this gives the best code size. My
implementation takes one instruction more per round compared to
Gladman's x86 assembler but it doesn't require any stack for local
variables or saved registers and it is less serialized than Gladman's
x86 code.
Note that all comparisons to Gladman's code were done after my code was
implemented. I did only use FIPS PUB 197 for the implementation so my
implementation is independent work.
If anybody has a better assembler solution for x86_64 I'll be pleased to
have my code replaced with the better solution.
Testing:
========
The implementation passes the in-kernel crypto testing module and I'm
running it without any problems on my laptop where it is mainly used for
dm-crypt.
Microbenchmark:
===============
The microbenchmark was done in userspace with similar compile flags as
used during kernel compile.
Encrypt/decrypt is about 35% faster than the generic C implementation.
As the generic C as well as my assembler implementation are both table
driven I don't really expect that there is much room for further
improvements though I'll be glad to be corrected here.
The key schedule is about 5% slower than the generic C implementation.
This is due to the fact that some more work has to be done in the key
schedule routine to fit the schedule to the assembler implementation.
Code Size:
==========
Encrypt and decrypt are together about 2.1 Kbytes smaller than the
generic C implementation which is important with regard to L1 cache
usage. The key schedule routine is about 100 bytes larger than the
generic C implementation.
Data Size:
==========
There's no difference in data size requirements between the assembler
implementation and the generic C implementation.
License:
========
Gladmans's code is dual BSD/GPL whereas my assembler code is GPLv2 only
(I'm not going to change the license for my code). So I had to change
the module license for the x86_64 aes module from 'Dual BSD/GPL' to
'GPL' to reflect the most restrictive license within the module.
PS: It can happen that it may take a while until I can reply as I'm
regularly offline due to my current daytime job requirements.
--
Andreas Steinmetz SPAMmers use [email protected]
Please cc Herbert Xu on kernel crypto patches, he's the frontline
maintainer of it now.
- James
--
James Morris
<[email protected]>
On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
>
> Please cc Herbert Xu on kernel crypto patches, he's the frontline
> maintainer of it now.
Care to sign off this patch (or create a similar one)?
J?rn
--
The strong give up and move away, while the weak give up and stay.
-- unknown
Signed-off-by: J?rn Engel <[email protected]>
---
MAINTAINERS | 4 ++--
1 files changed, 2 insertions(+), 2 deletions(-)
--- linux-2.6.11cow/MAINTAINERS~crypto_maintainer 2005-03-04 11:39:53.000000000 +0100
+++ linux-2.6.11cow/MAINTAINERS 2005-04-18 10:43:40.963766936 +0200
@@ -596,8 +596,8 @@ W: http://developer.axis.com
S: Maintained
CRYPTO API
-P: James Morris
-M: [email protected]
+P: Herbert Xu
+M: [email protected]
P: David S. Miller
M: [email protected]
W http://samba.org/~jamesm/crypto/
> Microbenchmark:
> ===============
> The microbenchmark was done in userspace with similar compile flags as
> used during kernel compile.
> Encrypt/decrypt is about 35% faster than the generic C implementation.
> As the generic C as well as my assembler implementation are both table
> driven I don't really expect that there is much room for further
> improvements though I'll be glad to be corrected here.
On what CPUs did you benchmark? I suppose results will vary a lot
between AMD and Intel x86-64 CPUs.
-Andi
James Morris wrote:
> Please cc Herbert Xu on kernel crypto patches, he's the frontline
> maintainer of it now.
>
>
> - James
Already done on request by Herbert Xu himself.
--
Andreas Steinmetz SPAMmers use [email protected]
Andi Kleen wrote:
> On what CPUs did you benchmark? I suppose results will vary a lot
> between AMD and Intel x86-64 CPUs.
AMD. I don't have any Intel around.
--
Andreas Steinmetz SPAMmers use [email protected]
J?rn Engel wrote:
> On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
>
>>Please cc Herbert Xu on kernel crypto patches, he's the frontline
>>maintainer of it now.
>
>
> Care to sign off this patch (or create a similar one)?
No problem, will do after the review by Herbert Xu is done (I guess
there will be some changes required).
--
Andreas Steinmetz SPAMmers use [email protected]
On Mon, 18 Apr 2005, J?rn Engel wrote:
> On Mon, 18 April 2005 03:50:32 -0400, James Morris wrote:
> >
> > Please cc Herbert Xu on kernel crypto patches, he's the frontline
> > maintainer of it now.
>
> Care to sign off this patch (or create a similar one)?
No, it's already been done in Linus' kernel weeks ago.
- James
--
James Morris
<[email protected]>
On Sun, 2005-04-17 at 21:19 +0200, Andreas Steinmetz wrote:
> Implementation:
> ===============
> The encrypt/decrypt code is based on an x86 implementation I did a while
> ago which I never published. This unpublished implementation does
> include an assembler based key schedule and precomputed tables.
Nice work! Especially because I'm planing to get one of these x86_64
babies soon ;)
> If anybody has a better assembler solution for x86_64 I'll be pleased to
> have my code replaced with the better solution.
Jari Ruusu has a x86_64 implementation in his loop-AES package. It is
also based on Gladman's code.
http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2 aes-amd64.S
> Microbenchmark:
> ===============
> The microbenchmark was done in userspace with similar compile flags as
> used during kernel compile.
You might want to compare it to the one above.
Regards,
--
Fruhwirth Clemens - http://clemens.endorphin.org
for robots: [email protected]
On Thu, 28 Apr 2005, Fruhwirth Clemens wrote:
> > If anybody has a better assembler solution for x86_64 I'll be pleased to
> > have my code replaced with the better solution.
>
> http://loop-aes.sourceforge.net/loop-AES-latest.tar.bz2 aes-amd64.S
Jari's code cannot be included in the kernel.
- James
--
James Morris
<[email protected]>