![Page 1: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/1.jpg)
1
Smartphone/tablet CPUs
iPad 1 (2010) was the
first popular tablet:
more than 15 million sold.
iPad 1 contains 45nm
Apple A4 system-on-chip.
Apple A4 contains
1GHz ARM Cortex-A8 CPU core
+ PowerVR SGX 535 GPU.
Cortex-A8 CPU core (2005)
supports ARMv7-A insn set,
including NEON vector insns.
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
![Page 2: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/2.jpg)
1
Smartphone/tablet CPUs
iPad 1 (2010) was the
first popular tablet:
more than 15 million sold.
iPad 1 contains 45nm
Apple A4 system-on-chip.
Apple A4 contains
1GHz ARM Cortex-A8 CPU core
+ PowerVR SGX 535 GPU.
Cortex-A8 CPU core (2005)
supports ARMv7-A insn set,
including NEON vector insns.
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
![Page 3: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/3.jpg)
1
Smartphone/tablet CPUs
iPad 1 (2010) was the
first popular tablet:
more than 15 million sold.
iPad 1 contains 45nm
Apple A4 system-on-chip.
Apple A4 contains
1GHz ARM Cortex-A8 CPU core
+ PowerVR SGX 535 GPU.
Cortex-A8 CPU core (2005)
supports ARMv7-A insn set,
including NEON vector insns.
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
![Page 4: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/4.jpg)
1
Smartphone/tablet CPUs
iPad 1 (2010) was the
first popular tablet:
more than 15 million sold.
iPad 1 contains 45nm
Apple A4 system-on-chip.
Apple A4 contains
1GHz ARM Cortex-A8 CPU core
+ PowerVR SGX 535 GPU.
Cortex-A8 CPU core (2005)
supports ARMv7-A insn set,
including NEON vector insns.
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
![Page 5: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/5.jpg)
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
![Page 6: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/6.jpg)
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once.
![Page 7: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/7.jpg)
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once.
![Page 8: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/8.jpg)
2
Apple A4 also appeared
in iPhone 4 (2010).
45nm 1GHz Samsung Exynos
3110 in Samsung Galaxy S (2010)
contains Cortex-A8 CPU core.
45nm 1GHz TI OMAP3630 in
Motorola Droid X (2010)
contains Cortex-A8 CPU core.
65nm 800MHz Freescale i.MX50
in Amazon Kindle 4 (2011)
contains Cortex-A8 CPU core.
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once.
![Page 9: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/9.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once.
![Page 10: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/10.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
![Page 11: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/11.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
![Page 12: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/12.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
![Page 13: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/13.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
![Page 14: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/14.jpg)
3
ARM designed more cores
supporting same ARMv7-A insns:
Cortex-A9 (2007),
Cortex-A5 (2009),
Cortex-A15 (2010),
Cortex-A7 (2011),
Cortex-A17 (2014), etc.
Also some larger 64-bit cores.
A9, A15, A17, and some 64-bit
cores are “out of order”: CPU
tries to reorder instructions to
compensate for dumb compilers.
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
![Page 15: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/15.jpg)
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
![Page 16: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/16.jpg)
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
![Page 17: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/17.jpg)
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
![Page 18: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/18.jpg)
4
A5, A7, original A8 are in-order,
fewer insns at once. ⇒ Simpler,
cheaper, more energy-efficient.
More than one billion Cortex-A7
devices have been sold.
Popular in low-cost and mid-range
smartphones: Mobiistar Buddy,
Mobiistar Kool, Mobiistar LAI Z1,
Samsung Galaxy J1 Ace Neo, etc.
Also used in typical TV boxes,
Sony SmartWatch 3, Samsung
Gear S2, Raspberry Pi 2, etc.
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
![Page 19: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/19.jpg)
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
![Page 20: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/20.jpg)
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
![Page 21: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/21.jpg)
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
![Page 22: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/22.jpg)
5
NEON crypto
Basic ARM insn set uses
16 32-bit registers: 512 bits.
Optional NEON extension uses
16 128-bit registers: 2048 bits.
Cortex-A7 and Cortex-A8
(and Cortex-A15 and Cortex-A17
and Qualcomm Scorpion
and Qualcomm Krait)
always have NEON insns.
Cortex-A5 and Cortex-A9
sometimes have NEON insns.
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
![Page 23: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/23.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
![Page 24: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/24.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
![Page 25: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/25.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
![Page 26: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/26.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
![Page 27: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/27.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
![Page 28: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/28.jpg)
6
2012 Bernstein–Schwabe
“NEON crypto” software:
new Cortex-A8 speed records
for various crypto primitives.
e.g. Curve25519 ECDH:
460200 cycles on Cortex-A8-fast,
498284 cycles on Cortex-A8-slow.
Compare to OpenSSL
cycles on Cortex-A8-slow
for NIST P-256 ECDH:
9 million for OpenSSL 0.9.8k.
4.8 million for OpenSSL 1.0.1c.
3.9 million for OpenSSL 1.0.2j.
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
![Page 29: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/29.jpg)
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
![Page 30: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/30.jpg)
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
![Page 31: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/31.jpg)
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
![Page 32: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/32.jpg)
7
NEON instructions
4x a = b + c
is a vector of 4 32-bit additions:
a[0] = b[0] + c[0];
a[1] = b[1] + c[1];
a[2] = b[2] + c[2];
a[3] = b[3] + c[3].
Cortex-A8 NEON arithmetic unit
can do this every cycle.
Stage N2: reads b and c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 cycles // ADD
2 cycles // ADD
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
![Page 33: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/33.jpg)
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
![Page 34: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/34.jpg)
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
![Page 35: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/35.jpg)
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
![Page 36: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/36.jpg)
8
4x a = b - c
is a vector of 4 32-bit subtractions:
a[0] = b[0] - c[0];
a[1] = b[1] - c[1];
a[2] = b[2] - c[2];
a[3] = b[3] - c[3].
Stage N1: reads c.
Stage N2: reads b, negates c.
Stage N3: performs addition.
Stage N4: a is ready.
ADD2 or 3 cycles // SUB
Also logic insns, shifts, etc.
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
![Page 37: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/37.jpg)
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
![Page 38: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/38.jpg)
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
![Page 39: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/39.jpg)
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
![Page 40: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/40.jpg)
9
Multiplication insn:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
Two cycles on Cortex-A8.
Multiply-accumulate insn:
c[0,1] += a[0] signed* b[0];
c[2,3] += a[1] signed* b[1]
Also two cycles on Cortex-A8.
Stage N1: reads b.
Stage N2: reads a.
Stage N3: reads c if accumulate....
Stage N8: c is ready.
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
![Page 41: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/41.jpg)
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
![Page 42: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/42.jpg)
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
![Page 43: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/43.jpg)
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
![Page 44: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/44.jpg)
10
Typical sequence of three insns:
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
c[0,1] += e[2] signed* f[2];
c[2,3] += e[3] signed* f[3]
c[0,1] += g[0] signed* h[2];
c[2,3] += g[1] signed* h[3]
Cortex-A8 recognizes this pattern.
Reads c in N6 instead of N3.
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
![Page 45: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/45.jpg)
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
![Page 46: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/46.jpg)
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
![Page 47: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/47.jpg)
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
![Page 48: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/48.jpg)
11Time N1 N2 N3 N4 N5 N6 N7 N8
1 b2 a3 f ×4 e ×5 h × ×6 g × ×7 × ×8 × × c9 × +
10 × c11 +12 c
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
![Page 49: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/49.jpg)
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
![Page 50: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/50.jpg)
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
![Page 51: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/51.jpg)
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
![Page 52: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/52.jpg)
12
NEON also has load/store insns
and permutation insns: e.g.,
r = s[1] t[2] r[2,3]
Cortex-A8 has a separate
NEON load/store unit
that runs in parallel with
NEON arithmetic unit.
Arithmetic is typically
most important bottleneck:
can often schedule insns
to hide loads/stores/perms.
Cortex-A7 is different: one unit
handling all NEON insns.
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
![Page 53: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/53.jpg)
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
![Page 54: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/54.jpg)
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
![Page 55: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/55.jpg)
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
![Page 56: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/56.jpg)
13
Curve25519 on NEON
Radix 225:5: Use small integers
(f0; f1; f2; f3; f4; f5; f6; f7; f8; f9)
to represent the integer
f = f0 + 226f1 + 251f2 + 277f3 +
2102f4 + 2128f5 + 2153f6 + 2179f7 +
2204f8 + 2230f9 modulo 2255 − 19.
Unscaled polynomial view:
f is value at 225:5 of the poly
f0t0 + 20:5f1t
1 + f2t2 + 20:5f3t
3 +
f4t4 + 20:5f5t
5 + f6t6 + 20:5f7t
7 +
f8t8 + 20:5f9t
9.
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
![Page 57: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/57.jpg)
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
![Page 58: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/58.jpg)
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
![Page 59: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/59.jpg)
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
![Page 60: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/60.jpg)
14
h ≡ f g (mod 2255 − 19) where
h0 = f0g0 +38f1g9 +19f2g8 +38f3g7 +19f4g6 +
h1 = f0g1 + f1g0 +19f2g9 +19f3g8 +19f4g7 +
h2 = f0g2 + 2f1g1 + f2g0 +38f3g9 +19f4g8 +
h3 = f0g3 + f1g2 + f2g1 + f3g0 +19f4g9 +
h4 = f0g4 + 2f1g3 + f2g2 + 2f3g1 + f4g0 +
h5 = f0g5 + f1g4 + f2g3 + f3g2 + f4g1 +
h6 = f0g6 + 2f1g5 + f2g4 + 2f3g3 + f4g2 +
h7 = f0g7 + f1g6 + f2g5 + f3g4 + f4g3 +
h8 = f0g8 + 2f1g7 + f2g6 + 2f3g5 + f4g4 +
h9 = f0g9 + f1g8 + f2g7 + f3g6 + f4g5 +
Proof: multiply polys mod t10 − 19.
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
![Page 61: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/61.jpg)
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
![Page 62: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/62.jpg)
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
![Page 63: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/63.jpg)
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
![Page 64: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/64.jpg)
15
38f5g5 +19f6g4 +38f7g3 +19f8g2 +38f9g1;
19f5g6 +19f6g5 +19f7g4 +19f8g3 +19f9g2;
38f5g7 +19f6g6 +38f7g5 +19f8g4 +38f9g3;
19f5g8 +19f6g7 +19f7g6 +19f8g5 +19f9g4;
38f5g9 +19f6g8 +38f7g7 +19f8g6 +38f9g5;
f5g0 +19f6g9 +19f7g8 +19f8g7 +19f9g6;
2f5g1 + f6g0 +38f7g9 +19f8g8 +38f9g7;
f5g2 + f6g1 + f7g0 +19f8g9 +19f9g8;
2f5g3 + f6g2 + 2f7g1 + f8g0 +38f9g9;
f5g4 + f6g3 + f7g2 + f8g1 + f9g0:
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
![Page 65: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/65.jpg)
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
![Page 66: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/66.jpg)
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
![Page 67: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/67.jpg)
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
![Page 68: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/68.jpg)
16
Each hi is a sum of ten
products after precomputation
of 2f1; 2f3; 2f5; 2f7; 2f9;
19g1; 19g2; : : : ; 19g9.
Each hi fits into 64 bits
under reasonable limits on
sizes of f1; g1; : : : ; f9; g9.
(Analyze this very carefully:
bugs can slip past most tests!
See 2011 Brumley–Page–
Barbosa–Vercauteren and
several recent OpenSSL bugs.)
h0; h1; : : : are too large
for subsequent multiplication.
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
![Page 69: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/69.jpg)
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
![Page 70: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/70.jpg)
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
![Page 71: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/71.jpg)
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
![Page 72: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/72.jpg)
17
Carry h0 → h1: i.e.,
replace (h0; h1) with
(h0 mod 226; h1 +¨h0=226
˝).
This makes h0 small.
Similarly for other hi .
Eventually all hi are small enough.
We actually use signed coeffs.
Slightly more expensive carries
(given details of insn set)
but more room for ab + c2 etc.
Some things we haven’t tried yet:
• Mix signed, unsigned carries.
• Interleave reduction, carrying.
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
![Page 73: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/73.jpg)
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
![Page 74: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/74.jpg)
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
![Page 75: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/75.jpg)
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
![Page 76: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/76.jpg)
18
Minor challenge: pipelining.
Result of each insn cannot be
used until a few cycles later.
Find an independent insn
for the CPU to start working on
while the first insn is in progress.
Sometimes helps to adjust
higher-level computations.
Example: carries h0 → h1 →h2 → h3 → h4 → h5 → h6 →h7 → h8 → h9 → h0 → h1
have long chain of dependencies.
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
![Page 77: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/77.jpg)
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
![Page 78: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/78.jpg)
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
![Page 79: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/79.jpg)
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
![Page 80: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/80.jpg)
19
Alternative: carry
h0 → h1 and h5 → h6;
h1 → h2 and h6 → h7;
h2 → h3 and h7 → h8;
h3 → h4 and h8 → h9;
h4 → h5 and h9 → h0;
h5 → h6 and h0 → h1.
12 carries instead of 11,
but latency is much smaller.
Now much easier
to find independent insns
for CPU to handle in parallel.
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
![Page 81: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/81.jpg)
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
![Page 82: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/82.jpg)
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
![Page 83: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/83.jpg)
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
![Page 84: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/84.jpg)
20
Major challenge: vectorization.
e.g. 4x a = b + c
does 4 additions at once,
but needs particular arrangement
of inputs and outputs.
On Cortex-A8,
occasional permutations
run in parallel with arithmetic,
but frequent permutations
would be a bottleneck.
On Cortex-A7,
every operation costs cycles.
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
![Page 85: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/85.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
![Page 86: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/86.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
![Page 87: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/87.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
![Page 88: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/88.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
![Page 89: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/89.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
![Page 90: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/90.jpg)
21
Often higher-level operations
do a pair of mults in parallel:
h = f g ; h′ = f ′g ′.
Vectorize across those mults.
Merge f0; f1; : : : ; f9and f ′0; f
′1; : : : ; f
′9
into vectors (fi ; f′i ).
Similarly (gi ; g′i ).
Then compute (hi ; h′i ).
Computation fits naturally
into NEON insns: e.g.,
c[0,1] = a[0] signed* b[0];
c[2,3] = a[1] signed* b[1]
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
![Page 91: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/91.jpg)
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
![Page 92: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/92.jpg)
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
![Page 93: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/93.jpg)
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
![Page 94: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/94.jpg)
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
![Page 95: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/95.jpg)
22
Example: Recall
C = X1 · X2; D = Y1 · Y2
inside point-addition formulas
for Edwards curves.
Example: Can compute
2P; 3P; 4P; 5P; 6P; 7P as
2P = P + P ;
3P = 2P + P and 4P = 2P + 2P ;
5P = 4P + P and 6P = 3P + 3P
and 7P = 4P + 3P .
Example: Typical algorithms
for fixed-base scalarmult
have many parallel point adds.
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
![Page 96: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/96.jpg)
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
![Page 97: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/97.jpg)
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
![Page 98: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/98.jpg)
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
![Page 99: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/99.jpg)
23
Example: A busy server
with a backlog of scalarmults
can vectorize across them.
Beware a disadvantage of
vectorizing across two mults:
256-bit f ; f ′; g ; g ′; h; h′
occupy at least 1536 bits,
leaving very little room
for temporary registers.
We use some loads and stores
inside vectorized mulmul.
Mostly invisible on Cortex-A8,
but bigger issue on Cortex-A7.
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
![Page 100: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/100.jpg)
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
![Page 101: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/101.jpg)
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
![Page 102: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/102.jpg)
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
![Page 103: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/103.jpg)
24
Some field ops are hard to pair
inside a single scalarmult.
Example: At end of ECDH,
convert fraction (X : Z) into
Z−1X ∈ {0; 1; : : : ; p − 1}.
Easy, constant time: Z−1 = Zp−2.
11M + 254S for p = 2255 − 19:
z2 = z1^2^1
z8 = z2^2^2
z9 = z1*z8
z11 = z2*z9
z22 = z11^2^1
z_5_0 = z9*z22
z_10_5 = z_5_0^2^5
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
![Page 104: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/104.jpg)
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
![Page 105: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/105.jpg)
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
![Page 106: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/106.jpg)
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
![Page 107: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/107.jpg)
25
z_10_0 = z_10_5*z_5_0
z_20_10 = z_10_0^2^10
z_20_0 = z_20_10*z_10_0
z_40_20 = z_20_0^2^20
z_40_0 = z_40_20*z_20_0
z_50_10 = z_40_0^2^10
z_50_0 = z_50_10*z_10_0
z_100_50 = z_50_0^2^50
z_100_0 = z_100_50*z_50_0
z_200_100 = z_100_0^2^100
z_200_0 = z_200_100*z_100_0
z_250_50 = z_200_0^2^50
z_250_0 = z_250_50*z_50_0
z_255_5 = z_250_0^2^5
z_255_21 = z_255_5*z11
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
![Page 108: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/108.jpg)
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
![Page 109: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/109.jpg)
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
![Page 110: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/110.jpg)
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
![Page 111: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/111.jpg)
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
![Page 112: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/112.jpg)
26
Can still vectorize
inside a single field op.
Strategy in our software:
50 mul insns starting from
(f0;2f1);(f2;2f3);(f4;2f5);(f6;2f7);(f8;2f9);
(f1;f8);(f3;f0);(f5;f2);(f7;f4);(f9;f6);
(g0;g1);(g2;g3);(g4;g5);(g6;g7);
(g0;19g1);(g2;19g3);(g4;19g5);(g6;19g7);(g8;19g9);
(19g2;19g3);(19g4;19g5);(19g6;19g7);(19g8;19g9);
(19g2;g3);(19g4;g5);(19g6;g7);(19g8;g9).
Change carry pattern to vectorize,
e.g., (h0; h4)→ (h1; h5).
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
![Page 113: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/113.jpg)
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
![Page 114: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/114.jpg)
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
Many interesting primitives
are far slower than necessary
on many important CPUs.
![Page 115: cr.yp.tocr.yp.to/talks/2016.12.02/slides-djb-20161202-highspeed-4x3.pdf · 1 Smartphone/tablet CPUs iPad 1 (2010) was the rst popular tablet: more than 15 million sold. iPad 1 contains](https://reader036.vdocuments.mx/reader036/viewer/2022080721/5f7b4552d6933a07f810f6d1/html5/thumbnails/115.jpg)
27
Core arithmetic: 100 cycles
on mul insns for each field mul.
Squarings are somewhat faster.
Some loss for carries etc.
ECDH: ≈10 field muls · 255 bits.
More detailed analysis:
356019 cycles on arithmetic;
≈78% of software’s total
Cortex-A8-fast cycles for ECDH.
Still some room for improvement.
Each CPU is a new adventure.
e.g. Could it be better to use
Cortex-A7 FPU with radix 221:25?
28
Much more work to do
https://bench.cr.yp.to:
benchmarks for (currently)
2137 public implementations of
hundreds of crypto primitives—
39 DH primitives,
56 signature primitives,
304 authenticated ciphers, etc.
Many interesting primitives
are far slower than necessary
on many important CPUs.
Exercise: Make them faster!