simd_fused.go

// SPDX-License-Identifier: Apache-2.0 OR MIT

//go:build goexperiment.simd && amd64

package c2simd

import (
	"encoding/binary"
	"fmt"
	"simd/archsimd"
)

const (
	c0Archtime uint32 = 0x61707865 // "expa"
	c1Archtime uint32 = 0x3320646e // "nd 3"
	c2Archtime uint32 = 0x79622d32 // "2-by"
	c3Archtime uint32 = 0x6b206574 // "te k"
)

var zeroPad16 [16]byte

// HChaCha20 dérive une sous-clé 256-bit à partir de key (32B) et nonce (16B).
// Exige key=32, nonce=16, out>=32 ; panique sinon (contrat aligné sur le repli scalaire).
func HChaCha20(key, nonce, out []byte) {
	HChaCha20_SIMD128(key, nonce, out)
}

// HChaCha20_SIMD128 (Double-Rounds Conformes HChaCha20 100% Registres Vectoriels)
func HChaCha20_SIMD128(key, nonce, out []byte) {
	if len(key) != 32 || len(nonce) != 16 || len(out) < 32 {
		panic("c2simd: HChaCha20 requires len(key)=32, len(nonce)=16, len(out)>=32")
	}

	k0 := binary.LittleEndian.Uint32(key[0:4])
	k1 := binary.LittleEndian.Uint32(key[4:8])
	k2 := binary.LittleEndian.Uint32(key[8:12])
	k3 := binary.LittleEndian.Uint32(key[12:16])
	k4 := binary.LittleEndian.Uint32(key[16:20])
	k5 := binary.LittleEndian.Uint32(key[20:24])
	k6 := binary.LittleEndian.Uint32(key[24:28])
	k7 := binary.LittleEndian.Uint32(key[28:32])

	n0 := binary.LittleEndian.Uint32(nonce[0:4])
	n1 := binary.LittleEndian.Uint32(nonce[4:8])
	n2 := binary.LittleEndian.Uint32(nonce[8:12])
	n3 := binary.LittleEndian.Uint32(nonce[12:16])

	v0 := archsimd.LoadUint32x4Array(&[4]uint32{c0Archtime, c1Archtime, c2Archtime, c3Archtime})
	v1 := archsimd.LoadUint32x4Array(&[4]uint32{k0, k1, k2, k3})
	v2 := archsimd.LoadUint32x4Array(&[4]uint32{k4, k5, k6, k7})
	v3 := archsimd.LoadUint32x4Array(&[4]uint32{n0, n1, n2, n3})

	// 10 itérations de Double-Rounds (20 rounds au total) sans accès mémoire intermédiaire
	for i := 0; i < 10; i++ {
		// Column Round
		v0 = v0.Add(v1)
		v3 = v3.Xor(v0).RotateAllLeft(16)
		v2 = v2.Add(v3)
		v1 = v1.Xor(v2).RotateAllLeft(12)
		v0 = v0.Add(v1)
		v3 = v3.Xor(v0).RotateAllLeft(8)
		v2 = v2.Add(v3)
		v1 = v1.Xor(v2).RotateAllLeft(7)

		// Diagonal Round (Permutations vectorielles directes)
		var b1 [4]uint32
		v1.StoreArray(&b1)
		v1 = archsimd.LoadUint32x4Array(&[4]uint32{b1[1], b1[2], b1[3], b1[0]})

		var b2 [4]uint32
		v2.StoreArray(&b2)
		v2 = archsimd.LoadUint32x4Array(&[4]uint32{b2[2], b2[3], b2[0], b2[1]})

		var b3 [4]uint32
		v3.StoreArray(&b3)
		v3 = archsimd.LoadUint32x4Array(&[4]uint32{b3[3], b3[0], b3[1], b3[2]})

		v0 = v0.Add(v1)
		v3 = v3.Xor(v0).RotateAllLeft(16)
		v2 = v2.Add(v3)
		v1 = v1.Xor(v2).RotateAllLeft(12)
		v0 = v0.Add(v1)
		v3 = v3.Xor(v0).RotateAllLeft(8)
		v2 = v2.Add(v3)
		v1 = v1.Xor(v2).RotateAllLeft(7)

		v1.StoreArray(&b1)
		v1 = archsimd.LoadUint32x4Array(&[4]uint32{b1[3], b1[0], b1[1], b1[2]})

		v2.StoreArray(&b2)
		v2 = archsimd.LoadUint32x4Array(&[4]uint32{b2[2], b2[3], b2[0], b2[1]})

		v3.StoreArray(&b3)
		v3 = archsimd.LoadUint32x4Array(&[4]uint32{b3[1], b3[2], b3[3], b3[0]})
	}

	var hk0, hk1 [4]uint32
	v0.StoreArray(&hk0)
	v3.StoreArray(&hk1)

	binary.LittleEndian.PutUint32(out[0:4], hk0[0])
	binary.LittleEndian.PutUint32(out[4:8], hk0[1])
	binary.LittleEndian.PutUint32(out[8:12], hk0[2])
	binary.LittleEndian.PutUint32(out[12:16], hk0[3])
	binary.LittleEndian.PutUint32(out[16:20], hk1[0])
	binary.LittleEndian.PutUint32(out[20:24], hk1[1])
	binary.LittleEndian.PutUint32(out[24:28], hk1[2])
	binary.LittleEndian.PutUint32(out[28:32], hk1[3])
}

// AEADLockSIMD256_Fused effectue le scellage conforme RFC 8439 / Monocypher en Pure Go (0 allocation)
func AEADLockSIMD256_Fused(key, nonce, ad, plaintext []byte) ([]byte, []byte, error) {
	var mac [16]byte
	cipherText, err := AEADLockSIMD256_FusedDst(nil, &mac, key, nonce, ad, plaintext)
	return cipherText, mac[:], err
}

// AEADLockSIMD256_FusedDst effectue le scellage en Pure Go (0 allocation si dstBuffer fourni).
// Le corps est celui du chemin sous-clé : HChaCha20 puis AEADSubkeyLockDst
// (équivalence documentée et testée par TestAEADSubkey_MatchesFusedXChaCha).
func AEADLockSIMD256_FusedDst(dstBuffer []byte, outMac *[16]byte, key, nonce, ad, plaintext []byte) ([]byte, error) {
	if len(key) != 32 {
		return nil, fmt.Errorf("c2simd: key must be 32 bytes")
	}
	if len(nonce) != 24 {
		return nil, fmt.Errorf("c2simd: XChaCha20 nonce must be 24 bytes")
	}
	var subKeyBlock [32]byte
	HChaCha20_SIMD128(key, nonce[0:16], subKeyBlock[:])
	var derivedNonce [12]byte
	copy(derivedNonce[4:12], nonce[16:24])
	return AEADSubkeyLockDst(dstBuffer, outMac, subKeyBlock[:], derivedNonce[:], ad, plaintext)
}

func ciphertextPadding(length int) int {
	rem := length % 16
	if rem == 0 {
		return 0
	}
	return 16 - rem
}

// AEADUnlockSIMD256_Fused effectue le déchiffrement authentifié (fail-closed)
func AEADUnlockSIMD256_Fused(key, nonce, ad, ciphertext, mac []byte) ([]byte, error) {
	return AEADUnlockSIMD256_FusedDst(nil, key, nonce, ad, ciphertext, mac)
}

// AEADUnlockSIMD256_FusedDst effectue le déchiffrement authentifié en Pure Go (0 allocation si dstBuffer fourni).
func AEADUnlockSIMD256_FusedDst(dstBuffer []byte, key, nonce, ad, ciphertext, mac []byte) ([]byte, error) {
	if len(key) != 32 {
		return nil, fmt.Errorf("c2simd: key must be 32 bytes")
	}
	if len(nonce) != 24 {
		return nil, fmt.Errorf("c2simd: XChaCha20 nonce must be 24 bytes")
	}
	if len(mac) != 16 {
		return nil, fmt.Errorf("c2simd: MAC tag must be 16 bytes")
	}
	var subKeyBlock [32]byte
	HChaCha20_SIMD128(key, nonce[0:16], subKeyBlock[:])
	var derivedNonce [12]byte
	copy(derivedNonce[4:12], nonce[16:24])
	return AEADSubkeyUnlockDst(dstBuffer, subKeyBlock[:], derivedNonce[:], ad, ciphertext, mac)
}