On x86-64 CPUs that support them, createCipheriv and createDecipheriv use
new kernels in scr_cipher_simd.c instead of the mbedTLS implementations:
AES-CTR encrypts eight blocks per step with AES-NI; AES-GCM encrypts eight
blocks per step while folding the previous step's ciphertext into GHASH
with PCLMULQDQ, or sixteen blocks per step with VAES and VPCLMULQDQ; CBC
decryption runs eight blocks per step, ChaCha20 runs eight blocks per
step with AVX2 or sixteen with AVX-512F, and Poly1305 processes eight
blocks per step with AVX-512 IFMA or four with 64-bit scalar arithmetic.
CPU support is checked with CPUID and XCR0 when a cipher is created;
other CPUs and architectures keep the mbedTLS path. The GCM kernel
enforces the same message and AAD limits as mbedTLS, so a failed update
retires the context on either path.
A runtime C test (cipher-kernels.test.ts) checks both paths against 500
Node-generated cases with several chunkings (and the eight-block GCM loop
on VAES hosts), cipher.test.ts checks the GCM limits through the kernels,
and new corpus programs cover bulk data, counter carries, non-12-byte GCM
IVs, chacha20-poly1305 batches and tampered inputs.
Chris Tate
4eac513f61