SM4: 单block的性能问题

[emmansun]

当前用AES-NI实现的encryptBlockAsm的性能，比不上使用查表方法（预计算了L变换：Lookup(j) = L(sbox[j])）的纯golang实现，当然目前实现的查表方法是非constant-time实现，如果实现constant-time查表，性能会显著下降。

Constant-Time实现：

// T
func t(in uint32) uint32 {
	var b uint32

	b = getSboxValue(byte(in))
	b |= getSboxValue(byte(in>>8)) << 8
	b |= getSboxValue(byte(in>>16)) << 16
	b |= getSboxValue(byte(in>>24)) << 24

	// L
	return b ^ (b<<2 | b>>30) ^ (b<<10 | b>>22) ^ (b<<18 | b>>14) ^ (b<<24 | b>>8)
}

func precompute_t(in uint32) uint32 {
	return getSboxTValue(&sbox_t0, byte(in>>24)) ^
		getSboxTValue(&sbox_t1, byte(in>>16)) ^
		getSboxTValue(&sbox_t2, byte(in>>8)) ^
		getSboxTValue(&sbox_t3, byte(in))
}

func getSboxTValue(box *[256]uint32, x byte) uint32 {
	ret := 0
	for i, v := range box {
		cond := subtle.ConstantTimeByteEq(byte(i), x)
		ret |= subtle.ConstantTimeSelect(cond, int(v), 0)
	}
	return uint32(ret)
}

func getSboxValue(x byte) uint32 {
	ret := 0
	for i, v := range sbox {
		cond := subtle.ConstantTimeByteEq(byte(i), x)
		ret |= subtle.ConstantTimeSelect(cond, int(v), 0)
	}
	return uint32(ret)
}

性能：

goos: windows
goarch: amd64
pkg: github.com/emmansun/gmsm/sm4
cpu: Intel(R) Core(TM) i5-9500 CPU @ 3.00GHz
BenchmarkEncrypt
BenchmarkEncrypt-6
   40726	     27236 ns/op	   0.59 MB/s	       0 B/op	       0 allocs/op

非Constant-Time实现（当前实现）性能：

goos: windows
goarch: amd64
pkg: github.com/emmansun/gmsm/sm4
cpu: Intel(R) Core(TM) i5-9500 CPU @ 3.00GHz
BenchmarkEncrypt
BenchmarkEncrypt-6
 8678527	       134.2 ns/op	 119.22 MB/s	       0 B/op	       0 allocs/op

所以用AES-NI实现，从安全性和性能平衡来讲，目前还是一个好的选择。

参考

• What are the issues of look-up table based implementations?
• Why don't table lookups run in constant time?

[emmansun]

看起来arm64下，使用aes-ni的单block性能还是下降很多的，所以先切回使用查表实现。

AES-NI
goos: darwin
goarch: arm64
BenchmarkSM4BCEncrypt1K
BenchmarkSM4BCEncrypt1K-8        	   45248	     23536 ns/op	  43.51 MB/s
BenchmarkSM4BCDecrypt1K
BenchmarkSM4BCDecrypt1K-8        	   52416	     22513 ns/op	  45.48 MB/s

查表
goos: darwin
goarch: arm64
BenchmarkSM4BCEncrypt1K
BenchmarkSM4BCEncrypt1K-8        	  109899	      9677 ns/op	 105.81 MB/s
BenchmarkSM4BCDecrypt1K
BenchmarkSM4BCDecrypt1K-8        	  140384	      8289 ns/op	 123.54 MB/s

[emmansun]

v0.25.0