Repository navigation
ARMv7 SM4-CBC: prepare encryption keys once per call - #3040
Merged
Merged
Conversation
reaperhulk
force-pushed
the
codex/arm-sm4-prepared-cbc-encrypt
branch
from
October 21, 2026 17:50
818216b to
7ebc3db
Compare
This was referenced Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
ARMv7 SM4-CBC encryption called the full ECB entry point for each feedback block, preparing the same round keys repeatedly. Prepare the bitsliced keys once per call, XOR each plaintext block with the preceding ciphertext (or IV), then encrypt and retain the result for the next feedback step.
Enable the generated ARM/Thumb implementation with complete functional and constant-time proofs against the unchanged shared CBC encryption contract. The proofs cover arbitrary lengths, empty input, continuation IVs, memory frames and ABI preservation. The verified stack wrapper wipes all 1512 bytes of working space; stack use falls from 1560 to 1520 bytes. No specification or TCB changes.
Validation: full Lean build (22437 jobs), scoped emitter generation/audits and generated-code checks, public-import checks on all 11 changed modules, static checks, CBC integration tests, ARM/Thumb assembly compilation, ARM Clippy and Rustfmt. Native ARM/Thumb benchmark passed; Full CI after rebasing passed, including native ARM/Thumb tests, Lean, emitter audits and static checks.
Rebased onto main after #3037/#3036 merged; this diff contains only CBC encryption changes. CBC decryption is unchanged in this diff; #3034 separately batches decryption. The serial core still computes eight lanes for each feedback block, so this change does not claim to close the entire OpenSSL gap.
Thumb disassembly confirms the hot round loop is word-aligned at function offset
0x578; the padding is a verified identity.CBC encryption timings in microseconds, paired against the parent on Neoverse N2 (lower is better):
Bulk encryption improves by 17.4% on ARM and 18.3% on Thumb, but remains 6.4 times slower than OpenSSL. The rebase changes no CBC code, and the merged parent tree is byte-identical to the benchmark's parent. CBC decryption in this comparison uses main's serial implementation; #3034 independently replaces it with eight-block batches and beats OpenSSL at 1 KiB and 16 KiB.