Further simplify the rc4 implementation.

The RC4_CHUNK related code is intended to process native word sized
chunks if the input and output are naturally aligned. However, RC4_CHUNK
is currently a mess of machine dependent defines.

Replace this with uint64_t on all architectures - 64 bit architectures will
be happy with this and on 32 bit architectures the compiler can decompose
this into multiple 32 bit operations. Provide separate rc4_chunk()
implementations for big and little endian, since not all architectures
have a byte swap instruction that would make this a cheap conversion.

Thanks to gkoehler@ and tb@ for testing on big endian.

ok tb@

1 files changed, 45 insertions, 117 deletions

diff --git a/src/lib/libcrypto/rc4/rc4.c b/src/lib/libcrypto/rc4/rc4.c
index 9c0a61162d..69b7d0a815 100644
--- a/src/lib/libcrypto/rc4/rc4.c
+++ b/src/lib/libcrypto/rc4/rc4.c
@@ -1,4 +1,4 @@
-/* $OpenBSD: rc4.c,v 1.14 2025/08/14 14:55:43 jsing Exp $ */
+/* $OpenBSD: rc4.c,v 1.15 2025/08/17 08:04:25 jsing Exp $ */
 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com)
  * All rights reserved.
  *
@@ -57,22 +57,15 @@
  */
 
 #include <endian.h>
+#include <stdint.h>
 
 #include <openssl/rc4.h>
 
 #include "crypto_arch.h"
 
-/* RC4 as implemented from a posting from
- * Newsgroups: sci.crypt
- * From: sterndark@netcom.com (David Sterndark)
- * Subject: RC4 Algorithm revealed.
- * Message-ID: <sternCvKL4B.Hyy@netcom.com>
- * Date: Wed, 14 Sep 1994 06:35:31 GMT
- */
-
 #ifdef HAVE_RC4_INTERNAL
-void rc4_internal(RC4_KEY *key, size_t len, const unsigned char *indata,
-    unsigned char *outdata);
+void rc4_internal(RC4_KEY *key, size_t len, const uint8_t *in,
+    uint8_t *out);
 
 #else
 static inline RC4_INT
@@ -89,9 +82,35 @@ rc4_step(RC4_INT *d, RC4_INT *x, RC4_INT *y)
         return d[(tx + ty) & 0xff];
 }
 
+#if BYTE_ORDER == BIG_ENDIAN
+static inline uint64_t
+rc4_chunk(RC4_INT *d, RC4_INT *x, RC4_INT *y)
+{
+        uint64_t chunk = 0;
+        size_t i;
+
+        for (i = 0; i < 8; i++)
+                chunk = chunk << 8 | (uint64_t)rc4_step(d, x, y);
+
+        return chunk;
+}
+
+#else
+static inline uint64_t
+rc4_chunk(RC4_INT *d, RC4_INT *x, RC4_INT *y)
+{
+        uint64_t chunk = 0;
+        size_t i;
+
+        for (i = 0; i < 8; i++)
+                chunk |= (uint64_t)rc4_step(d, x, y) << (i * 8);
+
+        return chunk;
+}
+#endif
+
 static void
-rc4_internal(RC4_KEY *key, size_t len, const unsigned char *indata,
-    unsigned char *outdata)
+rc4_internal(RC4_KEY *key, size_t len, const uint8_t *in, uint8_t *out)
 {
         RC4_INT *d, x, y;
         size_t i;
@@ -100,118 +119,27 @@ rc4_internal(RC4_KEY *key, size_t len, const unsigned char *indata,
         y = key->y;
         d = key->data;
 
-#if defined(RC4_CHUNK)
-        /*
-         * The original reason for implementing this(*) was the fact that
-         * pre-21164a Alpha CPUs don't have byte load/store instructions
-         * and e.g. a byte store has to be done with 64-bit load, shift,
-         * and, or and finally 64-bit store. Peaking data and operating
-         * at natural word size made it possible to reduce amount of
-         * instructions as well as to perform early read-ahead without
-         * suffering from RAW (read-after-write) hazard. This resulted
-         * in ~40%(**) performance improvement on 21064 box with gcc.
-         * But it's not only Alpha users who win here:-) Thanks to the
-         * early-n-wide read-ahead this implementation also exhibits
-         * >40% speed-up on SPARC and 20-30% on 64-bit MIPS (depending
-         * on sizeof(RC4_INT)).
-         *
-         * (*)  "this" means code which recognizes the case when input
-         *      and output pointers appear to be aligned at natural CPU
-         *      word boundary
-         * (**) i.e. according to 'apps/openssl speed rc4' benchmark,
-         *      crypto/rc4/rc4speed.c exhibits almost 70% speed-up...
-         *
-         * Caveats.
-         *
-         * - RC4_CHUNK="unsigned long long" should be a #1 choice for
-         *   UltraSPARC. Unfortunately gcc generates very slow code
-         *   (2.5-3 times slower than one generated by Sun's WorkShop
-         *   C) and therefore gcc (at least 2.95 and earlier) should
-         *   always be told that RC4_CHUNK="unsigned long".
-         *
-         *                                      <appro@fy.chalmers.se>
-         */
-
-# define RC4_STEP       ((RC4_CHUNK)rc4_step(d, &x, &y))
+        /* Process uint64_t chunks if 8 byte aligned. */
+        if ((((size_t)in | (size_t)out) % 8) == 0) {
+                while (len >= 8) {
+                        *(uint64_t *)out = *(const uint64_t *)in ^ rc4_chunk(d, &x, &y);
 
-        if ((((size_t)indata & (sizeof(RC4_CHUNK) - 1)) |
-            ((size_t)outdata & (sizeof(RC4_CHUNK) - 1))) == 0 ) {
-                RC4_CHUNK ichunk, otp;
-
-                /*
-                 * I reckon we can afford to implement both endian
-                 * cases and to decide which way to take at run-time
-                 * because the machine code appears to be very compact
-                 * and redundant 1-2KB is perfectly tolerable (i.e.
-                 * in case the compiler fails to eliminate it:-). By
-                 * suggestion from Terrel Larson <terr@terralogic.net>.
-                 *
-                 * Special notes.
-                 *
-                 * - compilers (those I've tried) don't seem to have
-                 *   problems eliminating either the operators guarded
-                 *   by "if (sizeof(RC4_CHUNK)==8)" or the condition
-                 *   expressions themselves so I've got 'em to replace
-                 *   corresponding #ifdefs from the previous version;
-                 * - I chose to let the redundant switch cases when
-                 *   sizeof(RC4_CHUNK)!=8 be (were also #ifdefed
-                 *   before);
-                 * - in case you wonder "&(sizeof(RC4_CHUNK)*8-1)" in
-                 *   [LB]ESHFT guards against "shift is out of range"
-                 *   warnings when sizeof(RC4_CHUNK)!=8
-                 *
-                 *                      <appro@fy.chalmers.se>
-                 */
-#if BYTE_ORDER == BIG_ENDIAN
-# define BESHFT(c)      (((sizeof(RC4_CHUNK)-(c)-1)*8)&(sizeof(RC4_CHUNK)*8-1))
-                for (; len & (0 - sizeof(RC4_CHUNK)); len -= sizeof(RC4_CHUNK)) {
-                        ichunk  = *(RC4_CHUNK *)indata;
-                        otp = RC4_STEP << BESHFT(0);
-                        otp |= RC4_STEP << BESHFT(1);
-                        otp |= RC4_STEP << BESHFT(2);
-                        otp |= RC4_STEP << BESHFT(3);
-                        if (sizeof(RC4_CHUNK) == 8) {
-                                otp |= RC4_STEP << BESHFT(4);
-                                otp |= RC4_STEP << BESHFT(5);
-                                otp |= RC4_STEP << BESHFT(6);
-                                otp |= RC4_STEP << BESHFT(7);
-                        }
-                        *(RC4_CHUNK *)outdata = otp^ichunk;
-                        indata += sizeof(RC4_CHUNK);
-                        outdata += sizeof(RC4_CHUNK);
-                }
-#else
-# define LESHFT(c)      (((c)*8)&(sizeof(RC4_CHUNK)*8-1))
-                for (; len & (0 - sizeof(RC4_CHUNK)); len -= sizeof(RC4_CHUNK)) {
-                        ichunk = *(RC4_CHUNK *)indata;
-                        otp = RC4_STEP;
-                        otp |= RC4_STEP << 8;
-                        otp |= RC4_STEP << 16;
-                        otp |= RC4_STEP << 24;
-                        if (sizeof(RC4_CHUNK) == 8) {
-                                otp |= RC4_STEP << LESHFT(4);
-                                otp |= RC4_STEP << LESHFT(5);
-                                otp |= RC4_STEP << LESHFT(6);
-                                otp |= RC4_STEP << LESHFT(7);
-                        }
-                        *(RC4_CHUNK *)outdata = otp ^ ichunk;
-                        indata += sizeof(RC4_CHUNK);
-                        outdata += sizeof(RC4_CHUNK);
+                        in += 8;
+                        out += 8;
+                        len -= 8;
                 }
-#endif
         }
-#endif
 
         while (len >= 8) {
                 for (i = 0; i < 8; i++)
-                        outdata[i] = rc4_step(d, &x, &y) ^ indata[i];
+                        out[i] = rc4_step(d, &x, &y) ^ in[i];
 
-                indata += 8;
-                outdata += 8;
+                in += 8;
+                out += 8;
                 len -= 8;
         }
         for (i = 0; i < len; i++)
-                outdata[i] = rc4_step(d, &x, &y) ^ indata[i];
+                out[i] = rc4_step(d, &x, &y) ^ in[i];
 
         key->x = x;
         key->y = y;
@@ -219,11 +147,11 @@ rc4_internal(RC4_KEY *key, size_t len, const unsigned char *indata,
 #endif
 
 #ifdef HAVE_RC4_SET_KEY_INTERNAL
-void rc4_set_key_internal(RC4_KEY *key, int len, const unsigned char *data);
+void rc4_set_key_internal(RC4_KEY *key, int len, const uint8_t *data);
 
 #else
 static inline void
-rc4_set_key_internal(RC4_KEY *key, int len, const unsigned char *data)
+rc4_set_key_internal(RC4_KEY *key, int len, const uint8_t *data)
 {
         RC4_INT *d, tmp;
         int idx1, idx2;