Small speedups for AES-GCM:

[brian-pane]

• Eliminate a copy in the GHASH(length) computation at the end.
• In the tag computation, instead of copying the 128-bit GHASH result into a u8 array and doing a bytewise XOR loop, load it into a u128 and do a vector XOR.

[brian-pane]

On aarch64, this provides a modest speedup when doing AES-GCM encryption on 2KB buffers:

Benchmarking aes128-gcm/graviola/2KB: Collecting 100 samples in estimated 5.0000 s (18M iterationsaes128-gcm/graviola/2KB time:   [273.14 ns 273.30 ns 273.46 ns]
                        thrpt:  [6.9749 GiB/s 6.9789 GiB/s 6.9829 GiB/s]
                 change:
                        time:   [−4.9639% −4.8024% −4.6415%] (p = 0.00 < 0.05)
                        thrpt:  [+4.8674% +5.0446% +5.2232%]

but it doesn't help on larger buffers (where the encrypt function spent proportionally less of its time in the code path that this patch addresses) :

Benchmarking aes128-gcm/graviola/8KB: Collecting 100 samples in estimated 5.0026 s (5.4M iterationaes128-gcm/graviola/8KB time:   [921.46 ns 921.73 ns 921.99 ns]
                        thrpt:  [8.2749 GiB/s 8.2773 GiB/s 8.2797 GiB/s]
                 change:
                        time:   [+0.3030% +0.4235% +0.5518%] (p = 0.00 < 0.05)
                        thrpt:  [−0.5487% −0.4217% −0.3021%]
                        Change within noise threshold.

I need to do some more work to get this working with x86_64.

[codspeed-hq]

Merging this PR will not alter performance

✅ 173 untouched benchmarks

---

_{Comparing brian-pane:aes-perf (9e575f7) with main (0bbcb9e)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 99.77%. Comparing base (0bbcb9e) to head (9e575f7).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #204      +/-   ##
==========================================
- Coverage   99.78%   99.77%   -0.01%     
==========================================
  Files         216      216              
  Lines       56500    56525      +25     
  Branches      230      230              
==========================================
+ Hits        56377    56400      +23     
- Misses         92       93       +1     
- Partials       31       32       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[brian-pane]

This is working on x86_64 now, but I can't tell whether it's any faster on that platform. I got inconsistent results that suggest my x86_64 VM test environment may be too noisy for reliable benchmarks:

Benchmarking aes128-gcm/graviola/32B: Collecting 100 samples in estimated 5.0002 s (40M iteratio
aes128-gcm/graviola/32B time:   [130.27 ns 132.11 ns 133.77 ns]
                        thrpt:  [228.14 MiB/s 231.01 MiB/s 234.27 MiB/s]
                 change:
                        time:   [+2.2419% +3.3012% +4.4374%] (p = 0.00 < 0.05)
                        thrpt:  [−4.2489% −3.1957% −2.1927%]
                        Performance has regressed.

Benchmarking aes128-gcm/graviola/2KB: Collecting 100 samples in estimated 5.0005 s (16M iteratio
aes128-gcm/graviola/2KB time:   [317.26 ns 317.44 ns 317.64 ns]
                        thrpt:  [6.0048 GiB/s 6.0085 GiB/s 6.0120 GiB/s]
                 change:
                        time:   [−8.1430% −8.0337% −7.9202%] (p = 0.00 < 0.05)
                        thrpt:  [+8.6014% +8.7355% +8.8649%]
                        Performance has improved.