polyval: implement Karatsuba multiplication for arm64

[ericlagergren]

Improves performance by ~200 MB/s on a 2020 M1.

[ericlagergren]

The code is taken from https://github.com/ericlagergren/polyval-rs/tree/dev, which also has "wide" implementations (8 blocks at a time), which has significantly better performance (~0.17 cycles per byte instead of ~2).

[ericlagergren]

I also have an x86 version I can submit as well if you'd like.

[tarcieri]

Parallel and x86 versions would be appreciated, although perhaps as separate PRs to ease reviewability

[tarcieri]

Tested locally on an M2 Max, where I observed the reported speedups.

Percentage-wise it's about a 17% speedup.

[ericlagergren]

Parallel and x86 versions would be appreciated, although perhaps as separate PRs to ease reviewability

Actually, your x86 implementation only uses 3 clmul instructions, so I don't think the serial version can be improved much.

I'll look at adding parallel implementations. Off hand, do you know if the current API supports it? The input probably needs to be in one contiguous buffer. (Maybe not?) But that's the common case, at least for stuff like non-interleaved AES-GCM-SIV or HCTR2.

[tarcieri]

Take a look at poly1305 for an example of a parallel multi-block backend (AVX2): https://github.com/RustCrypto/universal-hashes/blob/0054b30/poly1305/src/backend/avx2.rs#L188-L198