Cryptonight variant 2

Contains two modifications to improve ASIC resistance: shuffle and integer math.

Shuffle makes use of the whole 64-byte cache line instead of 16 bytes only, making Cryptonight 4 times more demanding for memory bandwidth.

Integer math adds 64:32 bit integer division followed by 64 bit integer square root, adding large and unavoidable computational latency to the main loop.

More details and performance numbers: https://github.com/SChernykh/xmr-stak-cpu/blob/master/README.md

tests/hash/main.cpp

@@ -33,9 +33,11 @@
 #include <iomanip>
 #include <ios>
 #include <string>
+#include <cfenv>
 
 #include "warnings.h"
 #include "crypto/hash.h"
+#include "crypto/variant2_int_sqrt.h"
 #include "../io.h"
 
 using namespace std;
@@ -57,6 +59,9 @@ extern "C" {
   static void cn_slow_hash_1(const void *data, size_t length, char *hash) {
     return cn_slow_hash(data, length, hash, 1/*variant*/, 0/*prehashed*/);
   }
+  static void cn_slow_hash_2(const void *data, size_t length, char *hash) {
+    return cn_slow_hash(data, length, hash, 2/*variant*/, 0/*prehashed*/);
+  }
 }
 POP_WARNINGS
 
@@ -67,7 +72,10 @@ struct hash_func {
 } hashes[] = {{"fast", cn_fast_hash}, {"slow", cn_slow_hash_0}, {"tree", hash_tree},
   {"extra-blake", hash_extra_blake}, {"extra-groestl", hash_extra_groestl},
   {"extra-jh", hash_extra_jh}, {"extra-skein", hash_extra_skein},
-  {"slow-1", cn_slow_hash_1}};
+  {"slow-1", cn_slow_hash_1}, {"slow-2", cn_slow_hash_2}};
+
+int test_variant2_int_sqrt();
+int test_variant2_int_sqrt_ref();
 
 int main(int argc, char *argv[]) {
   hash_f *f;
@@ -78,6 +86,36 @@ int main(int argc, char *argv[]) {
   size_t test = 0;
   bool error = false;
   if (argc != 3) {
+    if ((argc == 2) && (strcmp(argv[1], "variant2_int_sqrt") == 0)) {
+      if (test_variant2_int_sqrt_ref() != 0) {
+        return 1;
+      }
+      const int round_modes[3] = { FE_DOWNWARD, FE_TONEAREST, FE_UPWARD };
+      for (int i = 0; i < 3; ++i) {
+        std::fesetround(round_modes[i]);
+        const int result = test_variant2_int_sqrt();
+        if (result != 0) {
+          cerr << "FPU round mode was set to ";
+          switch (round_modes[i]) {
+            case FE_DOWNWARD:
+              cerr << "FE_DOWNWARD";
+              break;
+            case FE_TONEAREST:
+              cerr << "FE_TONEAREST";
+              break;
+            case FE_UPWARD:
+              cerr << "FE_UPWARD";
+              break;
+            default:
+              cerr << "unknown";
+              break;
+          }
+          cerr << endl;
+          return result;
+        }
+      }
+      return 0;
+    }
     cerr << "Wrong number of arguments" << endl;
     return 1;
   }
@@ -127,3 +165,165 @@ int main(int argc, char *argv[]) {
   }
   return error ? 1 : 0;
 }
+
+#if defined(__x86_64__) || (defined(_MSC_VER) && defined(_WIN64))
+
+#include <emmintrin.h>
+
+#if defined(_MSC_VER) || defined(__MINGW32__)
+  #include <intrin.h>
+#else
+  #include <wmmintrin.h>
+#endif
+
+#endif
+
+static inline bool test_variant2_int_sqrt_sse(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+#if defined(__x86_64__) || (defined(_MSC_VER) && defined(_WIN64))
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_SSE2();
+  VARIANT2_INTEGER_MATH_SQRT_FIXUP(sqrt_result);
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (SSE2 version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt_fp64(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+#if defined DBL_MANT_DIG && (DBL_MANT_DIG >= 50)
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_FP64();
+  VARIANT2_INTEGER_MATH_SQRT_FIXUP(sqrt_result);
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (FP64 version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+#endif
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt_ref(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+  uint64_t sqrt_result;
+  VARIANT2_INTEGER_MATH_SQRT_STEP_REF();
+  if (sqrt_result != correct_result) {
+    cerr << "Integer sqrt (reference version) returned incorrect result for N = " << sqrt_input << endl;
+    cerr << "Expected result: " << correct_result << endl;
+    cerr << "Returned result: " << sqrt_result << endl;
+    return false;
+  }
+
+  return true;
+}
+
+static inline bool test_variant2_int_sqrt(const uint64_t sqrt_input, const uint64_t correct_result)
+{
+  if (!test_variant2_int_sqrt_sse(sqrt_input, correct_result)) {
+    return false;
+  }
+  if (!test_variant2_int_sqrt_fp64(sqrt_input, correct_result)) {
+    return false;
+  }
+
+  return true;
+}
+
+int test_variant2_int_sqrt()
+{
+  if (!test_variant2_int_sqrt(0, 0)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt(1ULL << 63, 1930543745UL)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt(uint64_t(-1), 3558067407UL)) {
+    return 1;
+  }
+
+  for (uint64_t i = 1; i <= 3558067407UL; ++i) {
+    // "i" is integer part of "sqrt(2^64 + n) * 2 - 2^33"
+    // n = (i/2 + 2^32)^2 - 2^64
+
+    const uint64_t i0 = i >> 1;
+    uint64_t n1;
+    if ((i & 1) == 0) {
+      // n = (i/2 + 2^32)^2 - 2^64
+      // n = i^2/4 + 2*2^32*i/2 + 2^64 - 2^64
+      // n = i^2/4 + 2^32*i
+      // i is even, so i^2 is divisible by 4:
+      // n = (i^2 >> 2) + (i << 32)
+
+      // int_sqrt_v2(i^2/4 + 2^32*i - 1) must be equal to i - 1
+      // int_sqrt_v2(i^2/4 + 2^32*i) must be equal to i
+      n1 = i0 * i0 + (i << 32) - 1;
+    }
+    else {
+      // n = (i/2 + 2^32)^2 - 2^64
+      // n = i^2/4 + 2*2^32*i/2 + 2^64 - 2^64
+      // n = i^2/4 + 2^32*i
+      // i is odd, so i = i0*2+1 (i0 = i >> 1)
+      // n = (i0*2+1)^2/4 + 2^32*i
+      // n = (i0^2*4+i0*4+1)/4 + 2^32*i
+      // n = i0^2+i0+1/4 + 2^32*i
+      // i0^2+i0 + 2^32*i < n < i0^2+i0+1 + 2^32*i
+
+      // int_sqrt_v2(i0^2+i0 + 2^32*i) must be equal to i - 1
+      // int_sqrt_v2(i0^2+i0+1 + 2^32*i) must be equal to i
+      n1 = i0 * i0 + i0 + (i << 32);
+    }
+
+    if (!test_variant2_int_sqrt(n1, i - 1)) {
+      return 1;
+    }
+    if (!test_variant2_int_sqrt(n1 + 1, i)) {
+      return 1;
+    }
+  }
+
+  return 0;
+}
+
+int test_variant2_int_sqrt_ref()
+{
+  if (!test_variant2_int_sqrt_ref(0, 0)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt_ref(1ULL << 63, 1930543745UL)) {
+    return 1;
+  }
+  if (!test_variant2_int_sqrt_ref(uint64_t(-1), 3558067407UL)) {
+    return 1;
+  }
+
+  // Reference version is slow, so we test only every 83th edge case
+  // "i += 83" because 1 + 83 * 42868282 = 3558067407
+  for (uint64_t i = 1; i <= 3558067407UL; i += 83) {
+    const uint64_t i0 = i >> 1;
+    uint64_t n1;
+    if ((i & 1) == 0) {
+      n1 = i0 * i0 + (i << 32) - 1;
+    }
+    else {
+      n1 = i0 * i0 + i0 + (i << 32);
+    }
+
+    if (!test_variant2_int_sqrt_ref(n1, i - 1)) {
+      return 1;
+    }
+    if (!test_variant2_int_sqrt_ref(n1 + 1, i)) {
+      return 1;
+    }
+  }
+
+  return 0;
+}