ARMv8 Cryptography Extensions support

[tarcieri]

Adds a new backend which uses ARMv8 Cryptography Extensions. These are currently unstable so support is gated under a newly added armv8 crate feature.

These extensions are supported on both 32-bit and 64-bit ARM targets, however the current implementation is gated on aarch64 (as that's the only architecture it's been tested on so far).

• AES-128
• AES-192
• AES-256
• Check handling of non-aligned inputs

Closes #10.

[tarcieri]

Note: the implementation is using const generics. It's only using 1.51+ compatible features so far, and it's an internal implementation details, so I figured why not.

For comparison, the corresponding AES-NI implementation contains a lot of code duplication.

[tarcieri]

Tests are confirmed passing on an Apple M1

[tarcieri]

Some preliminary benchmarks on a M1 Mac Mini:

soft backend

test aes128_decrypt  ... bench:         268 ns/iter (+/- 2) = 59 MB/s
test aes128_decrypt8 ... bench:         523 ns/iter (+/- 5) = 244 MB/s
test aes128_encrypt  ... bench:         262 ns/iter (+/- 2) = 61 MB/s
test aes128_encrypt8 ... bench:         513 ns/iter (+/- 10) = 249 MB/s

test aes192_decrypt  ... bench:         311 ns/iter (+/- 1) = 51 MB/s
test aes192_decrypt8 ... bench:         611 ns/iter (+/- 4) = 209 MB/s
test aes192_encrypt  ... bench:         308 ns/iter (+/- 2) = 51 MB/s
test aes192_encrypt8 ... bench:         603 ns/iter (+/- 9) = 212 MB/s

test aes256_decrypt  ... bench:         357 ns/iter (+/- 1) = 44 MB/s
test aes256_decrypt8 ... bench:         704 ns/iter (+/- 5) = 181 MB/s
test aes256_encrypt  ... bench:         350 ns/iter (+/- 1) = 45 MB/s
test aes256_encrypt8 ... bench:         689 ns/iter (+/- 8) = 185 MB/s

ARMv8 intrinsics

test aes128_decrypt  ... bench:          12 ns/iter (+/- 0) = 1333 MB/s
test aes128_decrypt8 ... bench:          32 ns/iter (+/- 0) = 4000 MB/s
test aes128_encrypt  ... bench:          12 ns/iter (+/- 0) = 1333 MB/s
test aes128_encrypt8 ... bench:          31 ns/iter (+/- 0) = 4129 MB/s

test aes192_decrypt  ... bench:          13 ns/iter (+/- 0) = 1230 MB/s
test aes192_decrypt8 ... bench:          21 ns/iter (+/- 0) = 6095 MB/s
test aes192_encrypt  ... bench:          13 ns/iter (+/- 0) = 1230 MB/s
test aes192_encrypt8 ... bench:          22 ns/iter (+/- 0) = 5818 MB/s

test aes256_decrypt  ... bench:          16 ns/iter (+/- 1) = 1000 MB/s
test aes256_decrypt8 ... bench:          20 ns/iter (+/- 0) = 6400 MB/s
test aes256_encrypt  ... bench:          16 ns/iter (+/- 0) = 1000 MB/s
test aes256_encrypt8 ... bench:          20 ns/iter (+/- 0) = 6400 MB/s

[tarcieri]

Removing WIP.

I'd call this complete except for pipelining. It implements the following:

• AES-128/AES-192/AES-256 encryption/decryption
• Runtime CPU feature detection on Linux and macOS targets
• FIPS 197 test vectors for the 128/192/256-bit key schedules

I will look at pipelining, with an eye on what improves performance on the M1 (since that's the most powerful ARMv8 I have access to).

In the meantime I would love it if anyone could benchmark it on other 64-bit ARMv8 platforms. I'll leave this PR open for awhile to invite review.

[tarcieri]

Implemented pipelining which operates 8-blocks-at-a-time. Saw some pretty nice performance gains on the Apple M1 (reaching nearly 10GB/sec on AES-128!)

test aes128_decrypt  ... bench:          12 ns/iter (+/- 0) = 1333 MB/s
test aes128_decrypt8 ... bench:          13 ns/iter (+/- 0) = 9846 MB/s
test aes128_encrypt  ... bench:          12 ns/iter (+/- 0) = 1333 MB/s
test aes128_encrypt8 ... bench:          13 ns/iter (+/- 0) = 9846 MB/s

test aes192_decrypt  ... bench:          14 ns/iter (+/- 0) = 1142 MB/s
test aes192_decrypt8 ... bench:          15 ns/iter (+/- 0) = 8533 MB/s
test aes192_encrypt  ... bench:          14 ns/iter (+/- 0) = 1142 MB/s
test aes192_encrypt8 ... bench:          15 ns/iter (+/- 0) = 8533 MB/s

test aes256_decrypt  ... bench:          16 ns/iter (+/- 0) = 1000 MB/s
test aes256_decrypt8 ... bench:          17 ns/iter (+/- 0) = 7529 MB/s
test aes256_encrypt  ... bench:          16 ns/iter (+/- 0) = 1000 MB/s
test aes256_encrypt8 ... bench:          17 ns/iter (+/- 0) = 7529 MB/s

[tarcieri]

Going to go ahead and land this. At this point I'd say it's the best tested of all of the backends.