# std.crypto.onetimeauth.ghash: faster GHASH on modern CPUs \(\#13566\) · gitcafe/zig

[View on GitCafe](https://git.cafe/gitcafe/zig/commit/7cfeae1ce7aa9f1b3a219d032c43bc2e694ba63b)

Repository: [gitcafe/zig](https://git.cafe/gitcafe/zig)

Visibility: public

Requested revision: 7cfeae1ce7aa9f1b3a219d032c43bc2e694ba63b

Requested commit: 7cfeae1ce7aa9f1b3a219d032c43bc2e694ba63b

Commit: 7cfeae1ce7aa9f1b3a219d032c43bc2e694ba63b

Tree: 7818e427398bef4e3415a095db5bfe600fbd22fc

Author: Frank Denis

Committer: GitHub

## Message

```
std.crypto.onetimeauth.ghash: faster GHASH on modern CPUs (#13566)

* std.crypto.onetimeauth.ghash: faster GHASH on modern CPUs

Carryless multiplication was slow on older Intel CPUs, justifying
the need for using Karatsuba multiplication.

This is not the case any more; using 4 multiplications to multiply
two 128-bit numbers is actually faster than 3 multiplications +
shifts and additions.

This is also true on aarch64.

Keep using Karatsuba only when targeting x86 (granted, this is a bit
of a brutal shortcut, we should really list all the CPU models that
had a slow clmul instruction).

Also remove useless agg_2 treshold and restore the ability to
precompute only H and H^2 in ReleaseSmall.

Finally, avoid using u256. Using 128-bit registers is actually faster.

* Use a switch, add some comments
```

## Parents

- [58d9004cea5f8aa73c76382cd21e1c88b1bc21e1](https://git.cafe/gitcafe/zig/commit/58d9004cea5f8aa73c76382cd21e1c88b1bc21e1?format=markdown)

[Source at this commit](https://git.cafe/gitcafe/zig/tree/7cfeae1ce7aa9f1b3a219d032c43bc2e694ba63b?format=markdown)