Add option for "compact" rounds to aes_x86core.c. "Compact" rounds are
authorAndy Polyakov <appro@openssl.org>
Fri, 14 Jul 2006 09:57:55 +0000 (09:57 +0000)
committerAndy Polyakov <appro@openssl.org>
Fri, 14 Jul 2006 09:57:55 +0000 (09:57 +0000)
those referencing compact, 256-byte, S-boxes.

crypto/aes/Makefile
crypto/aes/aes_x86core.c

index 670256c818fbffd1e32b6fb0e58d89e76e664192..448760bd4b8b720183caab7b2c9d898250b37552 100644 (file)
@@ -103,6 +103,7 @@ aes_cbc.o: ../../include/openssl/opensslconf.h aes_cbc.c aes_locl.h
 aes_cfb.o: ../../e_os.h ../../include/openssl/aes.h
 aes_cfb.o: ../../include/openssl/e_os2.h ../../include/openssl/opensslconf.h
 aes_cfb.o: aes_cfb.c aes_locl.h
+aes_x86core.o: ../../include/openssl/aes.h aes_locl.h
 aes_core.o: ../../include/openssl/aes.h ../../include/openssl/e_os2.h
 aes_core.o: ../../include/openssl/opensslconf.h aes_core.c aes_locl.h
 aes_ctr.o: ../../include/openssl/aes.h ../../include/openssl/e_os2.h
index 3db36ff6102bee27ffab669e5e70a8724292d5fa..9a2ee0476d5f63db35f79f0e6e93c3ff0a8f90aa 100644 (file)
 #include <openssl/aes.h>
 #include "aes_locl.h"
 
+/*
+ * These two parameters control which table, 256-byte or 2KB, is
+ * referenced in outer and respectively inner rounds.
+ */
+#define AES_COMPACT_IN_OUTER_ROUNDS
+#ifdef  AES_COMPACT_IN_OUTER_ROUNDS
+/* AES_COMPACT_IN_OUTER_ROUNDS costs ~30% in performance, while
+ * adding AES_COMPACT_IN_INNER_ROUNDS reduces benchmark *further*
+ * by factor of ~2. */
+# undef  AES_COMPACT_IN_INNER_ROUNDS
+#endif
+
+#if 1
+static void prefetch256(const void *table)
+{
+       volatile unsigned long *t=(void *)table,ret;
+       unsigned long sum;
+       int i;
+
+       /* 32 is common least cache-line size */
+       for (sum=0,i=0;i<256/sizeof(t[0]);i+=32/sizeof(t[0]))   sum ^= t[i];
+
+       ret = sum;
+}
+#else
+# define prefetch256(t)
+#endif
+
 #undef GETU32
 #define GETU32(p) (*((u32*)(p)))
-#undef PUTU32
-#define PUTU32(ct,st) { *((u32*)(ct)) = (st); }
 
 #if (defined(_WIN32) || defined(_WIN64)) && !defined(__MINGW32__)
 typedef unsigned __int64 u64;
@@ -62,6 +88,21 @@ typedef unsigned long long u64;
 #define U64(C) C##ULL
 #endif
 
+#undef ROTATE
+#if defined(_MSC_VER) || defined(__ICC)
+# define ROTATE(a,n)   _lrotl(a,n)
+#elif defined(__GNUC__) && __GNUC__>=2
+# if defined(__i386) || defined(__i386__) || defined(__x86_64) || defined(__x86_64__)
+#   define ROTATE(a,n) ({ register unsigned int ret;   \
+                               asm (                   \
+                               "roll %1,%0"            \
+                               : "=r"(ret)             \
+                               : "I"(n), "0"(a)        \
+                               : "cc");                \
+                          ret;                         \
+                       })
+# endif
+#endif
 /*
 Te [x] = S [x].[02, 01, 01, 03, 02, 01, 01, 03];
 Te0[x] = S [x].[02, 01, 01, 03];
@@ -217,6 +258,41 @@ static const u64 Te[256] = {
     U64(0xd6bbbb6dd6bbbb6d), U64(0x3a16162c3a16162c)
 };
 
+static const u8 Te4[256] = {
+    0x63U, 0x7cU, 0x77U, 0x7bU, 0xf2U, 0x6bU, 0x6fU, 0xc5U,
+    0x30U, 0x01U, 0x67U, 0x2bU, 0xfeU, 0xd7U, 0xabU, 0x76U,
+    0xcaU, 0x82U, 0xc9U, 0x7dU, 0xfaU, 0x59U, 0x47U, 0xf0U,
+    0xadU, 0xd4U, 0xa2U, 0xafU, 0x9cU, 0xa4U, 0x72U, 0xc0U,
+    0xb7U, 0xfdU, 0x93U, 0x26U, 0x36U, 0x3fU, 0xf7U, 0xccU,
+    0x34U, 0xa5U, 0xe5U, 0xf1U, 0x71U, 0xd8U, 0x31U, 0x15U,
+    0x04U, 0xc7U, 0x23U, 0xc3U, 0x18U, 0x96U, 0x05U, 0x9aU,
+    0x07U, 0x12U, 0x80U, 0xe2U, 0xebU, 0x27U, 0xb2U, 0x75U,
+    0x09U, 0x83U, 0x2cU, 0x1aU, 0x1bU, 0x6eU, 0x5aU, 0xa0U,
+    0x52U, 0x3bU, 0xd6U, 0xb3U, 0x29U, 0xe3U, 0x2fU, 0x84U,
+    0x53U, 0xd1U, 0x00U, 0xedU, 0x20U, 0xfcU, 0xb1U, 0x5bU,
+    0x6aU, 0xcbU, 0xbeU, 0x39U, 0x4aU, 0x4cU, 0x58U, 0xcfU,
+    0xd0U, 0xefU, 0xaaU, 0xfbU, 0x43U, 0x4dU, 0x33U, 0x85U,
+    0x45U, 0xf9U, 0x02U, 0x7fU, 0x50U, 0x3cU, 0x9fU, 0xa8U,
+    0x51U, 0xa3U, 0x40U, 0x8fU, 0x92U, 0x9dU, 0x38U, 0xf5U,
+    0xbcU, 0xb6U, 0xdaU, 0x21U, 0x10U, 0xffU, 0xf3U, 0xd2U,
+    0xcdU, 0x0cU, 0x13U, 0xecU, 0x5fU, 0x97U, 0x44U, 0x17U,
+    0xc4U, 0xa7U, 0x7eU, 0x3dU, 0x64U, 0x5dU, 0x19U, 0x73U,
+    0x60U, 0x81U, 0x4fU, 0xdcU, 0x22U, 0x2aU, 0x90U, 0x88U,
+    0x46U, 0xeeU, 0xb8U, 0x14U, 0xdeU, 0x5eU, 0x0bU, 0xdbU,
+    0xe0U, 0x32U, 0x3aU, 0x0aU, 0x49U, 0x06U, 0x24U, 0x5cU,
+    0xc2U, 0xd3U, 0xacU, 0x62U, 0x91U, 0x95U, 0xe4U, 0x79U,
+    0xe7U, 0xc8U, 0x37U, 0x6dU, 0x8dU, 0xd5U, 0x4eU, 0xa9U,
+    0x6cU, 0x56U, 0xf4U, 0xeaU, 0x65U, 0x7aU, 0xaeU, 0x08U,
+    0xbaU, 0x78U, 0x25U, 0x2eU, 0x1cU, 0xa6U, 0xb4U, 0xc6U,
+    0xe8U, 0xddU, 0x74U, 0x1fU, 0x4bU, 0xbdU, 0x8bU, 0x8aU,
+    0x70U, 0x3eU, 0xb5U, 0x66U, 0x48U, 0x03U, 0xf6U, 0x0eU,
+    0x61U, 0x35U, 0x57U, 0xb9U, 0x86U, 0xc1U, 0x1dU, 0x9eU,
+    0xe1U, 0xf8U, 0x98U, 0x11U, 0x69U, 0xd9U, 0x8eU, 0x94U,
+    0x9bU, 0x1eU, 0x87U, 0xe9U, 0xceU, 0x55U, 0x28U, 0xdfU,
+    0x8cU, 0xa1U, 0x89U, 0x0dU, 0xbfU, 0xe6U, 0x42U, 0x68U,
+    0x41U, 0x99U, 0x2dU, 0x0fU, 0xb0U, 0x54U, 0xbbU, 0x16U
+};
+
 static const u64 Td[256] = {
     U64(0x50a7f45150a7f451), U64(0x5365417e5365417e),
     U64(0xc3a4171ac3a4171a), U64(0x965e273a965e273a),
@@ -548,7 +624,7 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
                 const AES_KEY *key) {
 
        const u32 *rk;
-       u32 s0, s1, s2, s3, t0, t1, t2, t3;
+       u32 s0, s1, s2, s3, t[4];
        int r;
 
        assert(in && out && key);
@@ -563,117 +639,193 @@ void AES_encrypt(const unsigned char *in, unsigned char *out,
        s2 = GETU32(in +  8) ^ rk[2];
        s3 = GETU32(in + 12) ^ rk[3];
 
-        t0 =
-            Te0[(s0      ) & 0xff] ^
-            Te1[(s1 >>  8) & 0xff] ^
-            Te2[(s2 >> 16) & 0xff] ^
-            Te3[(s3 >> 24)       ] ^
-            rk[4];
-        t1 =
-            Te0[(s1      ) & 0xff] ^
-            Te1[(s2 >>  8) & 0xff] ^
-            Te2[(s3 >> 16) & 0xff] ^
-            Te3[(s0 >> 24)       ] ^
-            rk[5];
-        t2 =
-            Te0[(s2      ) & 0xff] ^
-            Te1[(s3 >>  8) & 0xff] ^
-            Te2[(s0 >> 16) & 0xff] ^
-            Te3[(s1 >> 24)       ] ^
-            rk[6];
-        t3 =
-            Te0[(s3      ) & 0xff] ^
-            Te1[(s0 >>  8) & 0xff] ^
-            Te2[(s1 >> 16) & 0xff] ^
-            Te3[(s2 >> 24)       ] ^
-            rk[7];
+#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
+       prefetch256(Te4);
+
+       t[0] =  Te4[(s0      ) & 0xff]       ^
+               Te4[(s1 >>  8) & 0xff] <<  8 ^
+               Te4[(s2 >> 16) & 0xff] << 16 ^
+               Te4[(s3 >> 24)       ] << 24;
+       t[1] =  Te4[(s1      ) & 0xff]       ^
+               Te4[(s2 >>  8) & 0xff] <<  8 ^
+               Te4[(s3 >> 16) & 0xff] << 16 ^
+               Te4[(s0 >> 24)       ] << 24;
+       t[2] =  Te4[(s2      ) & 0xff]       ^
+               Te4[(s3 >>  8) & 0xff] <<  8 ^
+               Te4[(s0 >> 16) & 0xff] << 16 ^
+               Te4[(s1 >> 24)       ] << 24;
+       t[3] =  Te4[(s3      ) & 0xff]       ^
+               Te4[(s0 >>  8) & 0xff] <<  8 ^
+               Te4[(s1 >> 16) & 0xff] << 16 ^
+               Te4[(s2 >> 24)       ] << 24;
+
+       /* now do the linear transform using words */
+       {       int i;
+               u32 r0, r1, r2;
+
+               for (i = 0; i < 4; i++) {
+                       r0 = t[i];
+                       r1 = r0 & 0x80808080;
+                       r2 = ((r0 & 0x7f7f7f7f) << 1) ^
+                               ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
+#if defined(ROTATE)
+                       t[i] = r2 ^ ROTATE(r2,24) ^ ROTATE(r0,24) ^
+                               ROTATE(r0,16) ^ ROTATE(r0,8);
+#else
+                       t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^
+                               (r0 << 16) ^ (r0 >> 16) ^
+                               (r0 << 8) ^ (r0 >> 24);
+#endif
+                       t[i] ^= rk[4+i];
+               }
+       }
+#else
+       t[0] =  Te0[(s0      ) & 0xff] ^
+               Te1[(s1 >>  8) & 0xff] ^
+               Te2[(s2 >> 16) & 0xff] ^
+               Te3[(s3 >> 24)       ] ^
+               rk[4];
+       t[1] =  Te0[(s1      ) & 0xff] ^
+               Te1[(s2 >>  8) & 0xff] ^
+               Te2[(s3 >> 16) & 0xff] ^
+               Te3[(s0 >> 24)       ] ^
+               rk[5];
+       t[2] =  Te0[(s2      ) & 0xff] ^
+               Te1[(s3 >>  8) & 0xff] ^
+               Te2[(s0 >> 16) & 0xff] ^
+               Te3[(s1 >> 24)       ] ^
+               rk[6];
+       t[3] =  Te0[(s3      ) & 0xff] ^
+               Te1[(s0 >>  8) & 0xff] ^
+               Te2[(s1 >> 16) & 0xff] ^
+               Te3[(s2 >> 24)       ] ^
+               rk[7];
+#endif
+       s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
 
     /*
      * Nr - 2 full rounds:
      */
-    for (rk+=8,r=(key->rounds-2)>>1; r>0; rk+=8,r--) {
-        s0 =
-            Te0[(t0      ) & 0xff] ^
-            Te1[(t1 >>  8) & 0xff] ^
-            Te2[(t2 >> 16) & 0xff] ^
-            Te3[(t3 >> 24)       ] ^
-            rk[0];
-        s1 =
-            Te0[(t1      ) & 0xff] ^
-            Te1[(t2 >>  8) & 0xff] ^
-            Te2[(t3 >> 16) & 0xff] ^
-            Te3[(t0 >> 24)       ] ^
-            rk[1];
-        s2 =
-            Te0[(t2      ) & 0xff] ^
-            Te1[(t3 >>  8) & 0xff] ^
-            Te2[(t0 >> 16) & 0xff] ^
-            Te3[(t1 >> 24)       ] ^
-            rk[2];
-        s3 =
-            Te0[(t3      ) & 0xff] ^
-            Te1[(t0 >>  8) & 0xff] ^
-            Te2[(t1 >> 16) & 0xff] ^
-            Te3[(t2 >> 24)       ] ^
-            rk[3];
-        t0 =
-            Te0[(s0      ) & 0xff] ^
-            Te1[(s1 >>  8) & 0xff] ^
-            Te2[(s2 >> 16) & 0xff] ^
-            Te3[(s3 >> 24)       ] ^
-            rk[4];
-        t1 =
-            Te0[(s1      ) & 0xff] ^
-            Te1[(s2 >>  8) & 0xff] ^
-            Te2[(s3 >> 16) & 0xff] ^
-            Te3[(s0 >> 24)       ] ^
-            rk[5];
-        t2 =
-            Te0[(s2      ) & 0xff] ^
-            Te1[(s3 >>  8) & 0xff] ^
-            Te2[(s0 >> 16) & 0xff] ^
-            Te3[(s1 >> 24)       ] ^
-            rk[6];
-        t3 =
-            Te0[(s3      ) & 0xff] ^
-            Te1[(s0 >>  8) & 0xff] ^
-            Te2[(s1 >> 16) & 0xff] ^
-            Te3[(s2 >> 24)       ] ^
-            rk[7];
+    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
+#if defined(AES_COMPACT_IN_INNER_ROUNDS)
+       t[0] =  Te4[(s0      ) & 0xff]       ^
+               Te4[(s1 >>  8) & 0xff] <<  8 ^
+               Te4[(s2 >> 16) & 0xff] << 16 ^
+               Te4[(s3 >> 24)       ] << 24;
+       t[1] =  Te4[(s1      ) & 0xff]       ^
+               Te4[(s2 >>  8) & 0xff] <<  8 ^
+               Te4[(s3 >> 16) & 0xff] << 16 ^
+               Te4[(s0 >> 24)       ] << 24;
+       t[2] =  Te4[(s2      ) & 0xff]       ^
+               Te4[(s3 >>  8) & 0xff] <<  8 ^
+               Te4[(s0 >> 16) & 0xff] << 16 ^
+               Te4[(s1 >> 24)       ] << 24;
+       t[3] =  Te4[(s3      ) & 0xff]       ^
+               Te4[(s0 >>  8) & 0xff] <<  8 ^
+               Te4[(s1 >> 16) & 0xff] << 16 ^
+               Te4[(s2 >> 24)       ] << 24;
+
+       /* now do the linear transform using words */
+       {       int i;
+               u32 r0, r1, r2;
+
+               for (i = 0; i < 4; i++) {
+                       r0 = t[i];
+                       r1 = r0 & 0x80808080;
+                       r2 = ((r0 & 0x7f7f7f7f) << 1) ^
+                               ((r1 - (r1 >> 7)) & 0x1b1b1b1b);
+#if defined(ROTATE)
+                       t[i] = r2 ^ ROTATE(r2,24) ^ ROTATE(r0,24) ^
+                               ROTATE(r0,16) ^ ROTATE(r0,8);
+#else
+                       t[i] = r2 ^ ((r2 ^ r0) << 24) ^ ((r2 ^ r0) >> 8) ^
+                               (r0 << 16) ^ (r0 >> 16) ^
+                               (r0 << 8) ^ (r0 >> 24);
+#endif
+                       t[i] ^= rk[i];
+               }
+       }
+#else
+       t[0] =  Te0[(s0      ) & 0xff] ^
+               Te1[(s1 >>  8) & 0xff] ^
+               Te2[(s2 >> 16) & 0xff] ^
+               Te3[(s3 >> 24)       ] ^
+               rk[0];
+       t[1] =  Te0[(s1      ) & 0xff] ^
+               Te1[(s2 >>  8) & 0xff] ^
+               Te2[(s3 >> 16) & 0xff] ^
+               Te3[(s0 >> 24)       ] ^
+               rk[1];
+       t[2] =  Te0[(s2      ) & 0xff] ^
+               Te1[(s3 >>  8) & 0xff] ^
+               Te2[(s0 >> 16) & 0xff] ^
+               Te3[(s1 >> 24)       ] ^
+               rk[2];
+       t[3] =  Te0[(s3      ) & 0xff] ^
+               Te1[(s0 >>  8) & 0xff] ^
+               Te2[(s1 >> 16) & 0xff] ^
+               Te3[(s2 >> 24)       ] ^
+               rk[3];
+#endif
+       s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
     }
     /*
         * apply last round and
         * map cipher state to byte array block:
         */
-       s0 =
-               (Te2[(t0      ) & 0xff] & 0x000000ffU) ^
-               (Te3[(t1 >>  8) & 0xff] & 0x0000ff00U) ^
-               (Te0[(t2 >> 16) & 0xff] & 0x00ff0000U) ^
-               (Te1[(t3 >> 24)       ] & 0xff000000U) ^
+#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
+       prefetch256(Te4);
+
+       *(u32*)(out+0) =
+               Te4[(s0      ) & 0xff]       ^
+               Te4[(s1 >>  8) & 0xff] <<  8 ^
+               Te4[(s2 >> 16) & 0xff] << 16 ^
+               Te4[(s3 >> 24)       ] << 24 ^
                rk[0];
-       PUTU32(out     , s0);
-       s1 =
-               (Te2[(t1      ) & 0xff] & 0x000000ffU) ^
-               (Te3[(t2 >>  8) & 0xff] & 0x0000ff00U) ^
-               (Te0[(t3 >> 16) & 0xff] & 0x00ff0000U) ^
-               (Te1[(t0 >> 24)       ] & 0xff000000U) ^
+       *(u32*)(out+4) =
+               Te4[(s1      ) & 0xff]       ^
+               Te4[(s2 >>  8) & 0xff] <<  8 ^
+               Te4[(s3 >> 16) & 0xff] << 16 ^
+               Te4[(s0 >> 24)       ] << 24 ^
                rk[1];
-       PUTU32(out +  4, s1);
-       s2 =
-               (Te2[(t2      ) & 0xff] & 0x000000ffU) ^
-               (Te3[(t3 >>  8) & 0xff] & 0x0000ff00U) ^
-               (Te0[(t0 >> 16) & 0xff] & 0x00ff0000U) ^
-               (Te1[(t1 >> 24)       ] & 0xff000000U) ^
+       *(u32*)(out+8) =
+               Te4[(s2      ) & 0xff]       ^
+               Te4[(s3 >>  8) & 0xff] <<  8 ^
+               Te4[(s0 >> 16) & 0xff] << 16 ^
+               Te4[(s1 >> 24)       ] << 24 ^
                rk[2];
-       PUTU32(out +  8, s2);
-       s3 =
-               (Te2[(t3      ) & 0xff] & 0x000000ffU) ^
-               (Te3[(t0 >>  8) & 0xff] & 0x0000ff00U) ^
-               (Te0[(t1 >> 16) & 0xff] & 0x00ff0000U) ^
-               (Te1[(t2 >> 24)       ] & 0xff000000U) ^
+       *(u32*)(out+12) =
+               Te4[(s3      ) & 0xff]       ^
+               Te4[(s0 >>  8) & 0xff] <<  8 ^
+               Te4[(s1 >> 16) & 0xff] << 16 ^
+               Te4[(s2 >> 24)       ] << 24 ^
                rk[3];
-       PUTU32(out + 12, s3);
+#else
+       *(u32*)(out+0) =
+               (Te2[(s0      ) & 0xff] & 0x000000ffU) ^
+               (Te3[(s1 >>  8) & 0xff] & 0x0000ff00U) ^
+               (Te0[(s2 >> 16) & 0xff] & 0x00ff0000U) ^
+               (Te1[(s3 >> 24)       ] & 0xff000000U) ^
+               rk[0];
+       *(u32*)(out+4) =
+               (Te2[(s1      ) & 0xff] & 0x000000ffU) ^
+               (Te3[(s2 >>  8) & 0xff] & 0x0000ff00U) ^
+               (Te0[(s3 >> 16) & 0xff] & 0x00ff0000U) ^
+               (Te1[(s0 >> 24)       ] & 0xff000000U) ^
+               rk[1];
+       *(u32*)(out+8) =
+               (Te2[(s2      ) & 0xff] & 0x000000ffU) ^
+               (Te3[(s3 >>  8) & 0xff] & 0x0000ff00U) ^
+               (Te0[(s0 >> 16) & 0xff] & 0x00ff0000U) ^
+               (Te1[(s1 >> 24)       ] & 0xff000000U) ^
+               rk[2];
+       *(u32*)(out+12) =
+               (Te2[(s3      ) & 0xff] & 0x000000ffU) ^
+               (Te3[(s0 >>  8) & 0xff] & 0x0000ff00U) ^
+               (Te0[(s1 >> 16) & 0xff] & 0x00ff0000U) ^
+               (Te1[(s2 >> 24)       ] & 0xff000000U) ^
+               rk[3];
+#endif
 }
 
 /*
@@ -684,7 +836,7 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
                 const AES_KEY *key) {
 
        const u32 *rk;
-       u32 s0, s1, s2, s3, t0, t1, t2, t3;
+       u32 s0, s1, s2, s3, t[4];
        int r;
 
        assert(in && out && key);
@@ -699,115 +851,184 @@ void AES_decrypt(const unsigned char *in, unsigned char *out,
        s2 = GETU32(in +  8) ^ rk[2];
        s3 = GETU32(in + 12) ^ rk[3];
 
-        t0 =
-            Td0[(s0      ) & 0xff] ^
-            Td1[(s3 >>  8) & 0xff] ^
-            Td2[(s2 >> 16) & 0xff] ^
-            Td3[(s1 >> 24)       ] ^
-            rk[4];
-        t1 =
-            Td0[(s1      ) & 0xff] ^
-            Td1[(s0 >>  8) & 0xff] ^
-            Td2[(s3 >> 16) & 0xff] ^
-            Td3[(s2 >> 24)       ] ^
-            rk[5];
-        t2 =
-            Td0[(s2      ) & 0xff] ^
-            Td1[(s1 >>  8) & 0xff] ^
-            Td2[(s0 >> 16) & 0xff] ^
-            Td3[(s3 >> 24) & 0xff] ^
-            rk[6];
-        t3 =
-            Td0[(s3      ) & 0xff] ^
-            Td1[(s2 >>  8) & 0xff] ^
-            Td2[(s1 >> 16) & 0xff] ^
-            Td3[(s0 >> 24)       ] ^
-            rk[7];
+#if defined(AES_COMPACT_IN_OUTER_ROUNDS)
+       prefetch256(Td4);
+
+        t[0] = Td4[(s0      ) & 0xff]       ^
+               Td4[(s3 >>  8) & 0xff] <<  8 ^
+               Td4[(s2 >> 16) & 0xff] << 16 ^
+               Td4[(s1 >> 24)       ] << 24;
+        t[1] = Td4[(s1      ) & 0xff]       ^
+               Td4[(s0 >>  8) & 0xff] <<  8 ^
+               Td4[(s3 >> 16) & 0xff] << 16 ^
+               Td4[(s2 >> 24)       ] << 24;
+        t[2] = Td4[(s2      ) & 0xff]       ^
+               Td4[(s1 >>  8) & 0xff] <<  8 ^
+               Td4[(s0 >> 16) & 0xff] << 16 ^
+               Td4[(s3 >> 24)       ] << 24;
+        t[3] = Td4[(s3      ) & 0xff]       ^
+               Td4[(s2 >>  8) & 0xff] <<  8 ^
+               Td4[(s1 >> 16) & 0xff] << 16 ^
+               Td4[(s0 >> 24)       ] << 24;
+
+       /* now do the linear transform using words */ 
+       {       int i;
+               u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
+
+               for (i = 0; i < 4; i++) {
+                       tp1 = t[i];
+                       m = tp1 & 0x80808080;
+                       tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       m = tp2 & 0x80808080;
+                       tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       m = tp4 & 0x80808080;
+                       tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       tp9 = tp8 ^ tp1;
+                       tpb = tp9 ^ tp2;
+                       tpd = tp9 ^ tp4;
+                       tpe = tp8 ^ tp4 ^ tp2;
+#if defined(ROTATE)
+                       t[i] = tpe ^ ROTATE(tpd,16) ^
+                               ROTATE(tp9,8) ^ ROTATE(tpb,24);
+#else
+                       t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ 
+                               (tp9 >> 24) ^ (tp9 << 8) ^
+                               (tpb >> 8) ^ (tpb << 24);
+#endif
+                       t[i] ^= rk[4+i];
+               }
+       }
+#else
+       t[0] =  Td0[(s0      ) & 0xff] ^
+               Td1[(s3 >>  8) & 0xff] ^
+               Td2[(s2 >> 16) & 0xff] ^
+               Td3[(s1 >> 24)       ] ^
+               rk[4];
+       t[1] =  Td0[(s1      ) & 0xff] ^
+               Td1[(s0 >>  8) & 0xff] ^
+               Td2[(s3 >> 16) & 0xff] ^
+               Td3[(s2 >> 24)       ] ^
+               rk[5];
+       t[2] =  Td0[(s2      ) & 0xff] ^
+               Td1[(s1 >>  8) & 0xff] ^
+               Td2[(s0 >> 16) & 0xff] ^
+               Td3[(s3 >> 24)       ] ^
+               rk[6];
+       t[3] =  Td0[(s3      ) & 0xff] ^
+               Td1[(s2 >>  8) & 0xff] ^
+               Td2[(s1 >> 16) & 0xff] ^
+               Td3[(s0 >> 24)       ] ^
+               rk[7];
+#endif
+       s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
 
     /*
      * Nr - 2 full rounds:
      */
-    for (rk+=8,r=(key->rounds-2)>>1; r>0; rk+=8,r--) {
-        s0 =
-            Td0[(t0      ) & 0xff] ^
-            Td1[(t3 >>  8) & 0xff] ^
-            Td2[(t2 >> 16) & 0xff] ^
-            Td3[(t1 >> 24)       ] ^
-            rk[0];
-        s1 =
-            Td0[(t1      ) & 0xff] ^
-            Td1[(t0 >>  8) & 0xff] ^
-            Td2[(t3 >> 16) & 0xff] ^
-            Td3[(t2 >> 24)       ] ^
-            rk[1];
-        s2 =
-            Td0[(t2      ) & 0xff] ^
-            Td1[(t1 >>  8) & 0xff] ^
-            Td2[(t0 >> 16) & 0xff] ^
-            Td3[(t3 >> 24)       ] ^
-            rk[2];
-        s3 =
-            Td0[(t3      ) & 0xff] ^
-            Td1[(t2 >>  8) & 0xff] ^
-            Td2[(t1 >> 16) & 0xff] ^
-            Td3[(t0 >> 24)       ] ^
-            rk[3];
-
-        t0 =
-            Td0[(s0      ) & 0xff] ^
-            Td1[(s3 >>  8) & 0xff] ^
-            Td2[(s2 >> 16) & 0xff] ^
-            Td3[(s1 >> 24)       ] ^
-            rk[4];
-        t1 =
-            Td0[(s1      ) & 0xff] ^
-            Td1[(s0 >>  8) & 0xff] ^
-            Td2[(s3 >> 16) & 0xff] ^
-            Td3[(s2 >> 24)       ] ^
-            rk[5];
-        t2 =
-            Td0[(s2      ) & 0xff] ^
-            Td1[(s1 >>  8) & 0xff] ^
-            Td2[(s0 >> 16) & 0xff] ^
-            Td3[(s3 >> 24) & 0xff] ^
-            rk[6];
-        t3 =
-            Td0[(s3      ) & 0xff] ^
-            Td1[(s2 >>  8) & 0xff] ^
-            Td2[(s1 >> 16) & 0xff] ^
-            Td3[(s0 >> 24)       ] ^
-            rk[7];
+    for (rk+=8,r=key->rounds-2; r>0; rk+=4,r--) {
+#if defined(AES_COMPACT_IN_INNER_ROUNDS)
+        t[0] = Td4[(s0      ) & 0xff]       ^
+               Td4[(s3 >>  8) & 0xff] <<  8 ^
+               Td4[(s2 >> 16) & 0xff] << 16 ^
+               Td4[(s1 >> 24)       ] << 24;
+        t[1] = Td4[(s1      ) & 0xff]       ^
+               Td4[(s0 >>  8) & 0xff] <<  8 ^
+               Td4[(s3 >> 16) & 0xff] << 16 ^
+               Td4[(s2 >> 24)       ] << 24;
+        t[2] = Td4[(s2      ) & 0xff]       ^
+               Td4[(s1 >>  8) & 0xff] <<  8 ^
+               Td4[(s0 >> 16) & 0xff] << 16 ^
+               Td4[(s3 >> 24)       ] << 24;
+        t[3] = Td4[(s3      ) & 0xff]       ^
+               Td4[(s2 >>  8) & 0xff] <<  8 ^
+               Td4[(s1 >> 16) & 0xff] << 16 ^
+               Td4[(s0 >> 24)       ] << 24;
+
+       /* now do the linear transform using words */ 
+       {       int i;
+               u32 tp1, tp2, tp4, tp8, tp9, tpb, tpd, tpe, m;
+
+               for (i = 0; i < 4; i++) {
+                       tp1 = t[i];
+                       m = tp1 & 0x80808080;
+                       tp2 = ((tp1 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       m = tp2 & 0x80808080;
+                       tp4 = ((tp2 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       m = tp4 & 0x80808080;
+                       tp8 = ((tp4 & 0x7f7f7f7f) << 1) ^
+                               ((m - (m >> 7)) & 0x1b1b1b1b);
+                       tp9 = tp8 ^ tp1;
+                       tpb = tp9 ^ tp2;
+                       tpd = tp9 ^ tp4;
+                       tpe = tp8 ^ tp4 ^ tp2;
+#if defined(ROTATE)
+                       t[i] = tpe ^ ROTATE(tpd,16) ^
+                               ROTATE(tp9,8) ^ ROTATE(tpb,24);
+#else
+                       t[i] = tpe ^ (tpd >> 16) ^ (tpd << 16) ^ 
+                               (tp9 >> 24) ^ (tp9 << 8) ^
+                               (tpb >> 8) ^ (tpb << 24);
+#endif
+                       t[i] ^= rk[i];
+               }
+       }
+#else
+       t[0] =  Td0[(s0      ) & 0xff] ^
+               Td1[(s3 >>  8) & 0xff] ^
+               Td2[(s2 >> 16) & 0xff] ^
+               Td3[(s1 >> 24)       ] ^
+               rk[0];
+       t[1] =  Td0[(s1      ) & 0xff] ^
+               Td1[(s0 >>  8) & 0xff] ^
+               Td2[(s3 >> 16) & 0xff] ^
+               Td3[(s2 >> 24)       ] ^
+               rk[1];
+       t[2] =  Td0[(s2      ) & 0xff] ^
+               Td1[(s1 >>  8) & 0xff] ^
+               Td2[(s0 >> 16) & 0xff] ^
+               Td3[(s3 >> 24)       ] ^
+               rk[2];
+       t[3] =  Td0[(s3      ) & 0xff] ^
+               Td1[(s2 >>  8) & 0xff] ^
+               Td2[(s1 >> 16) & 0xff] ^
+               Td3[(s0 >> 24)       ] ^
+               rk[3];
+#endif
+       s0 = t[0]; s1 = t[1]; s2 = t[2]; s3 = t[3];
     }
     /*
         * apply last round and
         * map cipher state to byte array block:
         */
-       s0 =
-               (Td4[(t0      ) & 0xff])       ^
-               (Td4[(t3 >>  8) & 0xff] <<  8) ^
-               (Td4[(t2 >> 16) & 0xff] << 16) ^
-               (Td4[(t1 >> 24)       ] << 24) ^
-               rk[0];
-       PUTU32(out     , s0);
-       s1 =
-               (Td4[(t1      ) & 0xff])       ^
-               (Td4[(t0 >>  8) & 0xff] <<  8) ^
-               (Td4[(t3 >> 16) & 0xff] << 16) ^
-               (Td4[(t2 >> 24)       ] << 24) ^
-               rk[1];
-       PUTU32(out +  4, s1);
-       s2 =
-               (Td4[(t2      ) & 0xff])       ^
-               (Td4[(t1 >>  8) & 0xff] <<  8) ^
-               (Td4[(t0 >> 16) & 0xff] << 16) ^
-               (Td4[(t3 >> 24)       ] << 24) ^
-               rk[2];
-       PUTU32(out +  8, s2);
-       s3 =
-               (Td4[(t3      ) & 0xff])       ^
-               (Td4[(t2 >>  8) & 0xff] <<  8) ^
-               (Td4[(t1 >> 16) & 0xff] << 16) ^
-               (Td4[(t0 >> 24)       ] << 24) ^
-               rk[3];
-       PUTU32(out + 12, s3);
+       prefetch256(Td4);
+
+       *(u32*)(out+0) =
+               (Td4[(s0      ) & 0xff])        ^
+               (Td4[(s3 >>  8) & 0xff] <<  8) ^
+               (Td4[(s2 >> 16) & 0xff] << 16) ^
+               (Td4[(s1 >> 24)       ] << 24) ^
+               rk[0];
+       *(u32*)(out+4) =
+               (Td4[(s1      ) & 0xff])         ^
+               (Td4[(s0 >>  8) & 0xff] <<  8) ^
+               (Td4[(s3 >> 16) & 0xff] << 16) ^
+               (Td4[(s2 >> 24)       ] << 24) ^
+               rk[1];
+       *(u32*)(out+8) =
+               (Td4[(s2      ) & 0xff])         ^
+               (Td4[(s1 >>  8) & 0xff] <<  8) ^
+               (Td4[(s0 >> 16) & 0xff] << 16) ^
+               (Td4[(s3 >> 24)       ] << 24) ^
+               rk[2];
+       *(u32*)(out+12) =
+               (Td4[(s3      ) & 0xff])         ^
+               (Td4[(s2 >>  8) & 0xff] <<  8) ^
+               (Td4[(s1 >> 16) & 0xff] << 16) ^
+               (Td4[(s0 >> 24)       ] << 24) ^
+               rk[3];
 }