From ba71f11556d64e04af740ce59e3d98100db4a8ff Mon Sep 17 00:00:00 2001 From: Sun Yimin Date: Mon, 21 Aug 2023 15:11:27 +0800 Subject: [PATCH] =?UTF-8?q?Updated=20=E6=97=A0=E8=BF=9B=E4=BD=8D=E4=B9=98?= =?UTF-8?q?=E6=B3=95=E5=92=8CGHASH=20(markdown)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- 无进位乘法和GHASH.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/无进位乘法和GHASH.md b/无进位乘法和GHASH.md index 70be01b..434c393 100644 --- a/无进位乘法和GHASH.md +++ b/无进位乘法和GHASH.md @@ -56,8 +56,8 @@ vpxor T1, T1, T4 ; result in T1 * 4-way expanded Horner form (aggregate results to defer the reduction) * $MM[X_i , Hx] \oplus MM[X_{i-1} , {(Hx)}^2] \oplus MM[X_{i-2} , {(Hx)}^3] \oplus MM[(X_{i-3} \oplus Y_{i-4}, {(Hx)}^4] $ * Can be expanded to N > 4 blocks, we use 8 blocks now. - * Overhead: pre-calculate the powers of Hx (amortized for reasonably long buffer) - * The gain: reduction deffered to once per "N" blocks + * Overhead: pre-calculate the powers of $H \cdot x$ (amortized for reasonably long buffer) + * The gain: reduction deferred to once per "N" blocks # 参考 * [Cryptographic Hardware and Software and useful architectures](https://www.esat.kuleuven.be/cosic/events/ecrypt-net-school-2018/wp-content/uploads/sites/23/2018/10/kos-school-gueron-2.pdf)