Question

There are key self-contained algorithms – particularly cryptography-related such as AES, RSA, SHA1 etc – which you can find many implementations of for free on the internet.

Some are written to be nice and portable clean C.

Some are written to be fast – often with macros, and explicit unrolling.

As far as I can tell, none are trying to be especially super-small – so I’m resigned to writing my own – explicitly AES128 decryption and SHA1 for ARM THUMB2. (I’ve verified by compiling all I can find for my target machine with GCC with -Os and -mthumb and such)

What patterns and tricks can I use to do so?

Are there compilers/tools that can roll-up code?

Answer 1

It depends on what kind of space you are trying to optimise: code or data. There are essentially three variants of AES128 commonly in use, each differing in the amount of precomputed lookup table space.

• The fastest version uses 4k arranged as four 32-bit x 256 entry lookup tables (commonly called T-tables). If you can afford that amount of data space then the only instructions in this version are the EORs to combine the table results, these will roll up into a very small piece of code.
• The intermediate version uses a 8-bit x 256 entry lookup table to encode the SBox. The residual instructions need to implement the shift rows and mix columns steps so the code size is larger.
• The smallest (data-size) version doesn’t use any lookup tables at all, but needs to compute all of the individual AES-field operations including the inversion. This will use the most instructions, even if you fold both the field-multiply and inversion into subroutines.