cr.yp.to update

diff -ru .old-crypto/2005-590.html cr.yp.to/2005-590.html
--- .old-crypto/2005-590.html	Fri Mar 11 16:51:51 2005
+++ cr.yp.to/2005-590.html	Sat Mar 19 05:44:47 2005
@@ -514,5 +514,45 @@
 that inspects 3 authenticators,
 performs ``only'' 2^128 easy computations,
 and generates a successful forgery.
+<h2>18 March 2005</h2>
+Today I finished the discussion of AES speed.
+To summarize: AES has 200 lines.
+Four lines can be implemented as 4 shifts, 4 masks, 4 loads, 4 xors;
+or as 1 store, 4 loads, 4 shifts, 4 loads, 4 xors.
+The PowerPC has a combined shift-mask instruction.
+The x86 architecture has some trouble fitting AES into registers.
+<p>
+Required homework:
+What is the minimum number of UltraSPARC cycles for these 200 lines,
+with the right number of stores?
+Assume that there are no latency problems;
+consider only integer-execution-unit contention
+(at most two integer instructions in each cycle)
+and load/store-unit contention
+(at most one memory instruction in each cycle).
+Example, not the minimum:
+12 lines can be implemented as
+3 stores, 12 loads, 12 shifts, 12 loads, 12 xors,
+while the other 188 lines are implemented as
+188 shifts, 188 masks, 188 loads, 188 xors,
+for a total of 215 load/store instructions and 588 integer instructions,
+taking 294 cycles.
+<p>
+Optional homework:
+Figure out exactly how serious the store-to-load latency problems are
+on the UltraSPARC II (hint: nasty) and the UltraSPARC III (hint: better).
+This will require some experimentation;
+neither chip is adequately documented.
+<p>
+I spent the last few minutes briefly discussing cache-timing attacks on AES.
+If you're interested in learning more about this,
+check out my
+<a href="mac/variability1.html">pictures</a>
+and
+<a href="mac/variability2.html">graphs</a>
+of time variability.
+I also have a paper with more information on the topic,
+but I'm finishing a heavily revised version of the paper,
+so don't read it now.
 </body>
 </html>