[TLS] Re: Erlang/OTP and Bouncy Castle now supporting SLH-DS A in end-entity certificates

On Sat, Aug 15, 2026 at 08:36:03AM +0000, John Mattsson wrote:
> 
> Apple deserves a big round of applause for taking cryptography
> seriously. x64 CPU vendors, on the other hand, should be ashamed of
> having dedicated instructions for SHA-1 but not Keccak. Fortunately,
> (Turbo)SHAKE is quite performant even without dedicated hardware
> acceleration.

Adding dedicated instructions for Keccak is nontrivial due to the
200 byte Keccak state. Hacks that are fine ISA-wise might be less than
fine for microarchitecture. Adding new registers would require OS
support, and the x86 architecural register file is too big already
(some x86 instructions are disabled by default on Linux due to this).

The x86 SHA256 and SHA512 instructions already do very "interesting"
things with state. Both only writeback half state, and the lanes do
not match on input and output.




-Ilari

_______________________________________________
TLS mailing list -- [email protected]
To unsubscribe send an email to [email protected]