Add AArch64 implementation for 4-way parallel Keccak

[hanno-becker]

Partly implements: #33
Depends on: #35

Acceptance criteria:

• A mechanism is provided to replace the default C-implementation of the C-interface to 4-way parallel Keccak established in Add internal interface to 4-way Keccak and implement C-fallback #35 by alternative implementations.
• At least one alternative 4-way parallel Keccak implementation in AArch64 assembly is provided from Matthias' and Hanno's paper.

[mkannwischer]

I've started working on a cleaned up version of https://eprint.iacr.org/2022/1243 here: slothy-optimizer/slothy#65.
I'll likely start by adding a Keccakx1 implementation on the scalar unit first.
Then add hybrid implementations w/ and w/o SHA-3 instructions.

I think these 3 variants (potentially with different microarchitectural optimizations), should give us good performance on all target platforms. This will take a while though.

Formal verification could be done by equivalence checking using cryptoline: https://github.com/fmlab-iis/cryptoline/blob/master/examples/XKCP/KeccakP-1600/ARMv8A/KeccakP1600_Permute_24rounds.cl (which in turn uses equivalence checking to the Keccak's teams C reference implementation). A brief chat about this with the cryptoline developers suggests this is going to be easy.

[hanno-becker]

Formal verification could be done by equivalence checking using cryptoline: https://github.com/fmlab-iis/cryptoline/blob/master/examples/XKCP/KeccakP-1600/ARMv8A/KeccakP1600_Permute_24rounds.cl (which in turn uses equivalence checking to the Keccak's teams C reference implementation). A brief chat about this with the cryptoline developers suggests this is going to be easy.

Is this still your impression @mkannwischer ?

[mkannwischer]

Yes, this should not be hard and the CL developers say they have done this for Neon implementations both w/ and w/o SHA3 instructions before.
However, it is likely still going to be a bit of work. I'd very much prefer to have everything automated so we can run it regularly (maybe even in CI).

[hanno-becker]

Yes, this should not be hard and the CL developers say they have done this for Neon implementations both w/ and w/o SHA3 instructions before.
However, it is likely still going to be a bit of work. I'd very much prefer to have everything automated so we can run it regularly (maybe even in CI).

Ok, sound promising though. And regarding automation: One step a time.

[mkannwischer]

done by #137, #179