perf(crypto): XOR PBKDF2 blocks as 32-bit words and step 100 iterations

200 byte-wise iterations in one event tripped the 120,000-bytecode
watchdog on the Forerunner 255S profile. Word-wise XOR makes PBKDF2
2.3x faster (22 ms per 1000 iterations in the simulator).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

1 files changed, 76 insertions, 18 deletions

diff --git a/source/crypto/Kdf.mc b/source/crypto/Kdf.mc
index 07c97ba..5bace1c 100644
--- a/source/crypto/Kdf.mc
+++ b/source/crypto/Kdf.mc
@@ -25,8 +25,15 @@ module Kdf {
     // keeps the simulator (a PC) from choosing a count a watch can't afford.
     const MIN_ITERATIONS = 2000;
     const MAX_ITERATIONS = 200000;
-    // Iterations per job step: small enough for the 120,000-bytecode watchdog.
-    const ITERATIONS_PER_STEP = 200;
+    // Iterations per job step. The watchdog allows 120,000 bytecodes per
+    // event on the Forerunner 255/255S (240,000 elsewhere); 200 iterations of
+    // the byte-wise version tripped it there in the simulator (M4). With the
+    // word-wise XOR this keeps a wide margin; the UI flow derives PINs on the
+    // Forerunner 255S profile in every `make screenshots`.
+    const ITERATIONS_PER_STEP = 100;
+
+    // decodeNumber/encodeNumber options for one 32-bit word.
+    typedef WordOptions as {:offset as Number, :endianness as Lang.Endian};
 
     // PBKDF2-HMAC-SHA256 as a resumable job (RFC 8018 section 5.2).
     class Pbkdf2 extends Jobs.Job {
@@ -39,8 +46,20 @@ module Kdf {
         private var _block as Number = 1; // current output block, 1-based
         private var _done as Number = 0; // iterations done for the current block
         private var _u as ByteArray = []b;
-        private var _t as ByteArray = []b;
         private var _out as ByteArray = []b;
+        // T of the current block as eight 32-bit words: XOR-ing words takes
+        // far fewer bytecodes than XOR-ing 32 bytes, which matters for the
+        // per-event watchdog budget (see ITERATIONS_PER_STEP).
+        private var _t0 as Number = 0;
+        private var _t1 as Number = 0;
+        private var _t2 as Number = 0;
+        private var _t3 as Number = 0;
+        private var _t4 as Number = 0;
+        private var _t5 as Number = 0;
+        private var _t6 as Number = 0;
+        private var _t7 as Number = 0;
+        // decodeNumber options for word 0..7, built once.
+        private var _w as Array<WordOptions> = [] as Array<WordOptions>;
 
         // iterations >= 1; 1 <= length <= 255 * 32 bytes.
         function initialize(password as ByteArray, salt as ByteArray, iterations as Number, length as Number) {
@@ -56,44 +75,83 @@ module Kdf {
             _iterations = iterations;
             _length = length;
             _blockCount = (length + SHA256_BYTES - 1) / SHA256_BYTES;
+            for (var k = 0; k < 8; k++) {
+                _w.add({:offset => k * 4, :endianness => Lang.ENDIAN_BIG});
+            }
         }
 
         // Run up to `budget` iterations. Returns true when the key is complete.
         function step(budget as Number) as Boolean {
             var left = budget;
+            var f = Lang.NUMBER_FORMAT_SINT32;
+            var w = _w;
             while (left > 0 && _block <= _blockCount) {
                 if (_done == 0) {
-                    // U1 = HMAC(P, S || INT(i))
+                    // U1 = HMAC(P, S || INT(i)); T = U1
                     _mac.update(Bytes.concat(_salt, Bytes.uint32BigEndian(_block)));
                     _u = _mac.digest();
-                    _t = Bytes.copy(_u);
+                    var u = _u;
+                    _t0 = u.decodeNumber(f, w[0]) as Number;
+                    _t1 = u.decodeNumber(f, w[1]) as Number;
+                    _t2 = u.decodeNumber(f, w[2]) as Number;
+                    _t3 = u.decodeNumber(f, w[3]) as Number;
+                    _t4 = u.decodeNumber(f, w[4]) as Number;
+                    _t5 = u.decodeNumber(f, w[5]) as Number;
+                    _t6 = u.decodeNumber(f, w[6]) as Number;
+                    _t7 = u.decodeNumber(f, w[7]) as Number;
                 } else {
                     // Uj = HMAC(P, Uj-1); T ^= Uj. The previous Uj isn't wiped
                     // every iteration: it is useless without the password, and
-                    // a wipe loop per iteration would halve the iterations the
-                    // watch can afford in its time budget. The final values
-                    // are wiped below.
+                    // a wipe per iteration would cut the iterations the watch
+                    // can afford. The final values are wiped below.
                     _mac.update(_u);
                     _u = _mac.digest();
-                    var t = _t;
                     var u = _u;
-                    for (var i = 0; i < SHA256_BYTES; i++) {
-                        t[i] = t[i] ^ u[i];
-                    }
+                    _t0 ^= u.decodeNumber(f, w[0]) as Number;
+                    _t1 ^= u.decodeNumber(f, w[1]) as Number;
+                    _t2 ^= u.decodeNumber(f, w[2]) as Number;
+                    _t3 ^= u.decodeNumber(f, w[3]) as Number;
+                    _t4 ^= u.decodeNumber(f, w[4]) as Number;
+                    _t5 ^= u.decodeNumber(f, w[5]) as Number;
+                    _t6 ^= u.decodeNumber(f, w[6]) as Number;
+                    _t7 ^= u.decodeNumber(f, w[7]) as Number;
                 }
                 _done++;
                 left--;
                 if (_done == _iterations) {
-                    _out.addAll(_t);
-                    Bytes.wipe(_t);
-                    Bytes.wipe(_u);
-                    _block++;
-                    _done = 0;
+                    finishBlock();
                 }
             }
             return _block > _blockCount;
         }
 
+        // Append T to the output and clear it.
+        private function finishBlock() as Void {
+            var t = new [SHA256_BYTES]b;
+            var words = [_t0, _t1, _t2, _t3, _t4, _t5, _t6, _t7];
+            for (var k = 0; k < 8; k++) {
+                t.encodeNumber(words[k] as Number, Lang.NUMBER_FORMAT_SINT32, _w[k]);
+                words[k] = 0;
+            }
+            _out.addAll(t);
+            Bytes.wipe(t);
+            Bytes.wipe(_u);
+            clearWords();
+            _block++;
+            _done = 0;
+        }
+
+        private function clearWords() as Void {
+            _t0 = 0;
+            _t1 = 0;
+            _t2 = 0;
+            _t3 = 0;
+            _t4 = 0;
+            _t5 = 0;
+            _t6 = 0;
+            _t7 = 0;
+        }
+
         // The derived key; only valid after step() returned true.
         function result() as ByteArray {
             return _out.slice(0, _length);
@@ -102,9 +160,9 @@ module Kdf {
         // Wipe every intermediate value.
         function wipe() as Void {
             Bytes.wipe(_u);
-            Bytes.wipe(_t);
             Bytes.wipe(_out);
             Bytes.wipe(_salt);
+            clearWords();
         }
     }