← Watch feed
hashes: interleave two independent hashes for 2-way SHA256d
Public commit record
81/100 · Strong
What the developer wrote
Authored by jrakibi
hashes: interleave two independent hashes for 2-way SHA256d
ARM SHA256H/H2 instructions take 4 cycles to produce a
result. the next `SHA256H` needs the result of the current
one as input, so the CPU has to wait until it is ready.
(in Transform 2 for eg, 3 out of every 4 cycles are wasted
doing nothing)
we fill those wasted cycles by computing a second independent
hash alongside the first.
See https://developer.arm.com/documentation/PJDOC-466751330-7215/r4p1/
(Section 3.20) for Cortex-A76 instruction timings. The exact
latency may differ on other ARM chips but the concept is the
same
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
What changed, and why it matters
This commit is a performance optimization for SHA256 double hashing on 64-bit ARM processors. It rewrites a single-hash ARM hardware-accelerated routine to compute two independent hashes at the same time, filling otherwise wasted CPU cycles. There is no security bug being fixed and no new attack surface introduced; it is purely a speed improvement.
Recommended action
No security action required. Treat as a normal performance optimization. Reviewers may optionally verify that the two hash lanes do not share mutable state and that the output indexing is correct, but the diff shows clear variable separation and independent updates.
Security signals we found
01
No memory-safety changes: input/output lengths are fixed arrays and remain statically known
02
No new unsafe blocks or new target_feature flags introduced
03
No changes to public API or trait contracts visible in the diff
04
No constant tables or initial values modified
05
No branching, parsing, or user-controlled data handling added
Evidence from the diff
The patch renames sha256d_64_arm to sha256d_64_arm_2way and changes its signature from one 64-byte input/32-byte output to two 64-byte inputs and two 32-byte outputs. It duplicates the NEON/SHA2 state variables (state0_a/b, state1_a/b, message schedule variables, and temporaries) and interleaves the same ARM SHA256 instructions (vsha256hq_u32, vsha256h2q_u32, vsha256su0q_u32, vsha256su1q_u32) across the two independent hash lanes. Constants (INIT, K, MIDS, FINAL, FINS) are reused unchanged. The final stores write both results. The change is modeled on Bitcoin Core’s sha256d64_arm_shani::Transform_2way.
Changed components
hashes/src/sha256/crypto.rsARM aarch64 SHA256 hardware-accelerated implementation (sha2 extension)SHA256d 64-byte compression pathInspect captured patch +503 / −253
diff --git a/hashes/src/sha256/crypto.rs b/hashes/src/sha256/crypto.rs
index 262c5df5..709f752f 100644
--- a/hashes/src/sha256/crypto.rs
+++ b/hashes/src/sha256/crypto.rs
@@ -784,7 +784,9 @@ impl HashEngine {
#[cfg(all(target_arch = "aarch64", any(feature = "std", feature = "cpufeatures")))]
#[target_feature(enable = "sha2")]
- unsafe fn sha256d_64_arm(output: &mut [u8; 32], input: &[u8; 64]) {
+ unsafe fn sha256d_64_arm_2way(output: &mut [[u8; 32]; 2], input: &[[u8; 64]; 2]) {
+ // Based on Bitcoin Core's sha256d64_arm_shani::Transform_2way
+ // https://github.com/bitcoin/bitcoin/blob/master/src/crypto/sha256_arm_shani.cpp#L200-L895
use core::arch::aarch64::vst1q_u8;
// initial state
@@ -850,430 +852,678 @@ impl HashEngine {
0x80000000, 0, 0, 0, 0, 0, 0, 0x100,
];
- let (mut state0, mut state1);
- let (abcd_save, efgh_save);
+ let (mut state0_a, mut state0_b, mut state1_a, mut state1_b);
+ let (abcd_save_a, abcd_save_b, efgh_save_a, efgh_save_b);
- let (mut msg0, mut msg1, mut msg2, mut msg3);
- let (mut tmp0, mut tmp2, mut tmp);
+ let (mut msg0_a, mut msg0_b, mut msg1_a, mut msg1_b, mut msg2_a, mut msg2_b, mut msg3_a, mut msg3_b);
+ let (mut tmp0_a, mut tmp0_b, mut tmp2_a, mut tmp2_b, mut tmp);
// Load state
- state0 = vld1q_u32(INIT.as_ptr().add(0));
- state1 = vld1q_u32(INIT.as_ptr().add(4));
+ state0_a = vld1q_u32(INIT.as_ptr().add(0));
+ state0_b = state0_a;
+ state1_a = vld1q_u32(INIT.as_ptr().add(4));
+ state1_b = state1_a;
// Load message
- msg0 = vld1q_u32(input.as_ptr().add(0).cast::<u32>());
- msg1 = vld1q_u32(input.as_ptr().add(16).cast::<u32>());
- msg2 = vld1q_u32(input.as_ptr().add(32).cast::<u32>());
- msg3 = vld1q_u32(input.as_ptr().add(48).cast::<u32>());
+ msg0_a = vld1q_u32(input[0].as_ptr().add(0).cast::<u32>());
+ msg1_a = vld1q_u32(input[0].as_ptr().add(16).cast::<u32>());
+ msg2_a = vld1q_u32(input[0].as_ptr().add(32).cast::<u32>());
+ msg3_a = vld1q_u32(input[0].as_ptr().add(48).cast::<u32>());
+ msg0_b = vld1q_u32(input[1].as_ptr().add(0).cast::<u32>());
+ msg1_b = vld1q_u32(input[1].as_ptr().add(16).cast::<u32>());
+ msg2_b = vld1q_u32(input[1].as_ptr().add(32).cast::<u32>());
+ msg3_b = vld1q_u32(input[1].as_ptr().add(48).cast::<u32>());
// Reverse for little endian
- msg0 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg0)));
- msg1 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg1)));
- msg2 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg2)));
- msg3 = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg3)));
+ msg0_a = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg0_a)));
+ msg1_a = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg1_a)));
+ msg2_a = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg2_a)));
+ msg3_a = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg3_a)));
+ msg0_b = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg0_b)));
+ msg1_b = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg1_b)));
+ msg2_b = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg2_b)));
+ msg3_b = vreinterpretq_u32_u8(vrev32q_u8(vreinterpretq_u8_u32(msg3_b)));
// Transform 1: Rounds 1-4
tmp = vld1q_u32(K.as_ptr().add(0));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 1: Rounds 5-8
tmp = vld1q_u32(K.as_ptr().add(4));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 1: Rounds 9-12
tmp = vld1q_u32(K.as_ptr().add(8));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- msg2 = vsha256su0q_u32(msg2, msg3);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vsha256su0q_u32(msg2_a, msg3_a);
+ msg2_b = vsha256su0q_u32(msg2_b, msg3_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 1: Rounds 13-16
tmp = vld1q_u32(K.as_ptr().add(12));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 1: Rounds 17-20
tmp = vld1q_u32(K.as_ptr().add(16));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 1: Rounds 21-24
tmp = vld1q_u32(K.as_ptr().add(20));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 1: Rounds 25-28
tmp = vld1q_u32(K.as_ptr().add(24));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- msg2 = vsha256su0q_u32(msg2, msg3);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vsha256su0q_u32(msg2_a, msg3_a);
+ msg2_b = vsha256su0q_u32(msg2_b, msg3_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 1: Rounds 29-32
tmp = vld1q_u32(K.as_ptr().add(28));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 1: Rounds 33-36
tmp = vld1q_u32(K.as_ptr().add(32));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 1: Rounds 37-40
tmp = vld1q_u32(K.as_ptr().add(36));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 1: Rounds 41-44
tmp = vld1q_u32(K.as_ptr().add(40));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- msg2 = vsha256su0q_u32(msg2, msg3);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vsha256su0q_u32(msg2_a, msg3_a);
+ msg2_b = vsha256su0q_u32(msg2_b, msg3_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 1: Rounds 45-48
tmp = vld1q_u32(K.as_ptr().add(44));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 1: Rounds 49-52
tmp = vld1q_u32(K.as_ptr().add(48));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 1: Rounds 53-56
tmp = vld1q_u32(K.as_ptr().add(52));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 1: Rounds 57-60
tmp = vld1q_u32(K.as_ptr().add(56));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 1: Rounds 61-64
tmp = vld1q_u32(K.as_ptr().add(60));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 1: Update state
tmp = vld1q_u32(&INIT[0]);
- state0 = vaddq_u32(state0, tmp);
+ state0_a = vaddq_u32(state0_a, tmp);
+ state0_b = vaddq_u32(state0_b, tmp);
tmp = vld1q_u32(&INIT[4]);
- state1 = vaddq_u32(state1, tmp);
+ state1_a = vaddq_u32(state1_a, tmp);
+ state1_b = vaddq_u32(state1_b, tmp);
// ------------------ Transform 2 -------------------
// Transform 2: Save state
- abcd_save = state0;
- efgh_save = state1;
+ abcd_save_a = state0_a;
+ abcd_save_b = state0_b;
+ efgh_save_a = state1_a;
+ efgh_save_b = state1_b;
// Transform 2: Rounds 1-4
tmp = vld1q_u32(MIDS.as_ptr().add(0));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 5-8
tmp = vld1q_u32(MIDS.as_ptr().add(4));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 9-12
tmp = vld1q_u32(MIDS.as_ptr().add(8));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 13-16
tmp = vld1q_u32(MIDS.as_ptr().add(12));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 17-20
tmp = vld1q_u32(MIDS.as_ptr().add(16));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 21-24
tmp = vld1q_u32(MIDS.as_ptr().add(20));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 25-28
tmp = vld1q_u32(MIDS.as_ptr().add(24));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 29-32
tmp = vld1q_u32(MIDS.as_ptr().add(28));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 33-36
tmp = vld1q_u32(MIDS.as_ptr().add(32));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 37-40
tmp = vld1q_u32(MIDS.as_ptr().add(36));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 41-44
tmp = vld1q_u32(MIDS.as_ptr().add(40));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 45-48
tmp = vld1q_u32(MIDS.as_ptr().add(44));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 49-52
tmp = vld1q_u32(MIDS.as_ptr().add(48));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 53-56
tmp = vld1q_u32(MIDS.as_ptr().add(52));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 57-60
tmp = vld1q_u32(MIDS.as_ptr().add(56));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Rounds 61-64
tmp = vld1q_u32(MIDS.as_ptr().add(60));
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
// Transform 2: Update state
- state0 = vaddq_u32(state0, abcd_save);
- state1 = vaddq_u32(state1, efgh_save);
+ state0_a = vaddq_u32(state0_a, abcd_save_a);
+ state0_b = vaddq_u32(state0_b, abcd_save_b);
+ state1_a = vaddq_u32(state1_a, efgh_save_a);
+ state1_b = vaddq_u32(state1_b, efgh_save_b);
// ------------------ Transform 3 -------------------
- msg0 = state0;
- msg1 = state1;
- msg2 = vld1q_u32(FINAL.as_ptr().add(0));
- msg3 = vld1q_u32(FINAL.as_ptr().add(4));
+ msg0_a = state0_a;
+ msg0_b = state0_b;
+ msg1_a = state1_a;
+ msg1_b = state1_b;
+ msg2_a = vld1q_u32(FINAL.as_ptr().add(0));
+ msg2_b = msg2_a;
+ msg3_a = vld1q_u32(FINAL.as_ptr().add(4));
+ msg3_b = msg3_a;
// Transform 3: Load state
- state0 = vld1q_u32(INIT.as_ptr());
- state1 = vld1q_u32(INIT.as_ptr().add(4));
+ state0_a = vld1q_u32(INIT.as_ptr());
+ state0_b = state0_a;
+ state1_a = vld1q_u32(INIT.as_ptr().add(4));
+ state1_b = state1_a;
// Transform 3: Rounds 1-4
tmp = vld1q_u32(K.as_ptr().add(0));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 3: Rounds 5-8
tmp = vld1q_u32(K.as_ptr().add(4));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 3: Rounds 9-12
tmp = vld1q_u32(FINS.as_ptr().add(0));
- tmp2 = state0;
- msg2 = vld1q_u32(FINS.as_ptr().add(4));
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vld1q_u32(FINS.as_ptr().add(4));
+ msg2_b = msg2_a;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 3: Rounds 13-16
tmp = vld1q_u32(FINS.as_ptr().add(8));
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp);
- state1 = vsha256h2q_u32(state1, tmp2, tmp);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 3: Rounds 17-20
tmp = vld1q_u32(K.as_ptr().add(16));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 3: Rounds 21-24
tmp = vld1q_u32(K.as_ptr().add(20));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 3: Rounds 25-28
tmp = vld1q_u32(K.as_ptr().add(24));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- msg2 = vsha256su0q_u32(msg2, msg3);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vsha256su0q_u32(msg2_a, msg3_a);
+ msg2_b = vsha256su0q_u32(msg2_b, msg3_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 3: Rounds 29-32
tmp = vld1q_u32(K.as_ptr().add(28));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 3: Rounds 33-36
tmp = vld1q_u32(K.as_ptr().add(32));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- msg0 = vsha256su0q_u32(msg0, msg1);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg0 = vsha256su1q_u32(msg0, msg2, msg3);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg0_a = vsha256su0q_u32(msg0_a, msg1_a);
+ msg0_b = vsha256su0q_u32(msg0_b, msg1_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg0_a = vsha256su1q_u32(msg0_a, msg2_a, msg3_a);
+ msg0_b = vsha256su1q_u32(msg0_b, msg2_b, msg3_b);
// Transform 3: Rounds 37-40
tmp = vld1q_u32(K.as_ptr().add(36));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- msg1 = vsha256su0q_u32(msg1, msg2);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg1 = vsha256su1q_u32(msg1, msg3, msg0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg1_a = vsha256su0q_u32(msg1_a, msg2_a);
+ msg1_b = vsha256su0q_u32(msg1_b, msg2_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg1_a = vsha256su1q_u32(msg1_a, msg3_a, msg0_a);
+ msg1_b = vsha256su1q_u32(msg1_b, msg3_b, msg0_b);
// Transform 3: Rounds 41-44
tmp = vld1q_u32(K.as_ptr().add(40));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- msg2 = vsha256su0q_u32(msg2, msg3);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg2 = vsha256su1q_u32(msg2, msg0, msg1);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg2_a = vsha256su0q_u32(msg2_a, msg3_a);
+ msg2_b = vsha256su0q_u32(msg2_b, msg3_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg2_a = vsha256su1q_u32(msg2_a, msg0_a, msg1_a);
+ msg2_b = vsha256su1q_u32(msg2_b, msg0_b, msg1_b);
// Transform 3: Rounds 45-48
tmp = vld1q_u32(K.as_ptr().add(44));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- msg3 = vsha256su0q_u32(msg3, msg0);
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
- msg3 = vsha256su1q_u32(msg3, msg1, msg2);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ msg3_a = vsha256su0q_u32(msg3_a, msg0_a);
+ msg3_b = vsha256su0q_u32(msg3_b, msg0_b);
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
+ msg3_a = vsha256su1q_u32(msg3_a, msg1_a, msg2_a);
+ msg3_b = vsha256su1q_u32(msg3_b, msg1_b, msg2_b);
// Transform 3: Rounds 49-52
tmp = vld1q_u32(K.as_ptr().add(48));
- tmp0 = vaddq_u32(msg0, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg0_a, tmp);
+ tmp0_b = vaddq_u32(msg0_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 3: Rounds 53-56
tmp = vld1q_u32(K.as_ptr().add(52));
- tmp0 = vaddq_u32(msg1, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg1_a, tmp);
+ tmp0_b = vaddq_u32(msg1_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 3: Rounds 57-60
tmp = vld1q_u32(K.as_ptr().add(56));
- tmp0 = vaddq_u32(msg2, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg2_a, tmp);
+ tmp0_b = vaddq_u32(msg2_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 3: Rounds 61-64
tmp = vld1q_u32(K.as_ptr().add(60));
- tmp0 = vaddq_u32(msg3, tmp);
- tmp2 = state0;
- state0 = vsha256hq_u32(state0, state1, tmp0);
- state1 = vsha256h2q_u32(state1, tmp2, tmp0);
+ tmp0_a = vaddq_u32(msg3_a, tmp);
+ tmp0_b = vaddq_u32(msg3_b, tmp);
+ tmp2_a = state0_a;
+ tmp2_b = state0_b;
+ state0_a = vsha256hq_u32(state0_a, state1_a, tmp0_a);
+ state0_b = vsha256hq_u32(state0_b, state1_b, tmp0_b);
+ state1_a = vsha256h2q_u32(state1_a, tmp2_a, tmp0_a);
+ state1_b = vsha256h2q_u32(state1_b, tmp2_b, tmp0_b);
// Transform 3: Update state
tmp = vld1q_u32(INIT.as_ptr().add(0));
- state0 = vaddq_u32(state0, tmp);
+ state0_a = vaddq_u32(state0_a, tmp);
+ state0_b = vaddq_u32(state0_b, tmp);
tmp = vld1q_u32(INIT.as_ptr().add(4));
- state1 = vaddq_u32(state1, tmp);
+ state1_a = vaddq_u32(state1_a, tmp);
+ state1_b = vaddq_u32(state1_b, tmp);
// Store result
- vst1q_u8(output.as_mut_ptr().add(0), vrev32q_u8(vreinterpretq_u8_u32(state0)));
- vst1q_u8(output.as_mut_ptr().add(16), vrev32q_u8(vreinterpretq_u8_u32(state1)));
+ vst1q_u8(output[0].as_mut_ptr().add(0), vrev32q_u8(vreinterpretq_u8_u32(state0_a)));
+ vst1q_u8(output[0].as_mut_ptr().add(16), vrev32q_u8(vreinterpretq_u8_u32(state1_a)));
+ vst1q_u8(output[1].as_mut_ptr().add(0), vrev32q_u8(vreinterpretq_u8_u32(state0_b)));
+ vst1q_u8(output[1].as_mut_ptr().add(16), vrev32q_u8(vreinterpretq_u8_u32(state1_b)));
}
Risk score
Our methodology →Why this scored 18/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.