| 57 | } |
| 58 | |
| 59 | inline void ChaCha20Aligned::Keystream(std::span<std::byte> output) noexcept |
| 60 | { |
| 61 | std::byte* c = output.data(); |
| 62 | size_t blocks = output.size() / BLOCKLEN; |
| 63 | assert(blocks * BLOCKLEN == output.size()); |
| 64 | |
| 65 | uint32_t x0, x1, x2, x3, x4, x5, x6, x7, x8, x9, x10, x11, x12, x13, x14, x15; |
| 66 | uint32_t j4, j5, j6, j7, j8, j9, j10, j11, j12, j13, j14, j15; |
| 67 | |
| 68 | if (!blocks) return; |
| 69 | |
| 70 | j4 = input[0]; |
| 71 | j5 = input[1]; |
| 72 | j6 = input[2]; |
| 73 | j7 = input[3]; |
| 74 | j8 = input[4]; |
| 75 | j9 = input[5]; |
| 76 | j10 = input[6]; |
| 77 | j11 = input[7]; |
| 78 | j12 = input[8]; |
| 79 | j13 = input[9]; |
| 80 | j14 = input[10]; |
| 81 | j15 = input[11]; |
| 82 | |
| 83 | for (;;) { |
| 84 | x0 = 0x61707865; |
| 85 | x1 = 0x3320646e; |
| 86 | x2 = 0x79622d32; |
| 87 | x3 = 0x6b206574; |
| 88 | x4 = j4; |
| 89 | x5 = j5; |
| 90 | x6 = j6; |
| 91 | x7 = j7; |
| 92 | x8 = j8; |
| 93 | x9 = j9; |
| 94 | x10 = j10; |
| 95 | x11 = j11; |
| 96 | x12 = j12; |
| 97 | x13 = j13; |
| 98 | x14 = j14; |
| 99 | x15 = j15; |
| 100 | |
| 101 | // The 20 inner ChaCha20 rounds are unrolled here for performance. |
| 102 | REPEAT10( |
| 103 | QUARTERROUND( x0, x4, x8,x12); |
| 104 | QUARTERROUND( x1, x5, x9,x13); |
| 105 | QUARTERROUND( x2, x6,x10,x14); |
| 106 | QUARTERROUND( x3, x7,x11,x15); |
| 107 | QUARTERROUND( x0, x5,x10,x15); |
| 108 | QUARTERROUND( x1, x6,x11,x12); |
| 109 | QUARTERROUND( x2, x7, x8,x13); |
| 110 | QUARTERROUND( x3, x4, x9,x14); |
| 111 | ); |
| 112 | |
| 113 | x0 += 0x61707865; |
| 114 | x1 += 0x3320646e; |
| 115 | x2 += 0x79622d32; |
| 116 | x3 += 0x6b206574; |