aes: Implement encrypt_iv_xor_block in terms of ctr32 sometimes.

src/aead/aes.rs

@@ -223,10 +223,29 @@ impl Key {
         }
     }
 
-    #[inline]
-    pub fn encrypt_iv_xor_block(&self, iv: Iv, input: Block, cpu_features: cpu::Features) -> Block {
-        let encrypted_iv = self.encrypt_block(iv.into_block_less_safe(), cpu_features);
-        constant_time::xor_16(encrypted_iv, input)
+    pub fn encrypt_iv_xor_block(
+        &self,
+        iv: Iv,
+        mut block: Block,
+        cpu_features: cpu::Features,
+    ) -> Block {
+        let use_ctr32 = match detect_implementation(cpu_features) {
+            // These have specialized one-block implementations.
+            #[cfg(any(target_arch = "aarch64", target_arch = "x86_64", target_arch = "x86"))]
+            Implementation::HWAES => true,
+            // `ctr32_encrypt_within` calls `encrypt_iv_xor_block` on `target_arch = "x86"`.
+            #[cfg(any(target_arch = "aarch64", target_arch = "arm", target_arch = "x86_64"))]
+            Implementation::VPAES_BSAES => true,
+            _ => false,
+        };
+        if use_ctr32 {
+            let mut ctr = Counter(iv.0); // We're only doing one block so this is OK.
+            self.ctr32_encrypt_within(&mut block, 0.., &mut ctr, cpu_features);
+            block
+        } else {
+            let encrypted_iv = self.encrypt_block(iv.into_block_less_safe(), cpu_features);
+            constant_time::xor_16(encrypted_iv, block)
+        }
     }
 
     #[inline]