keccak: AVX2/AVX512 optimizations

[tarcieri]

I was looking through XKCP (eXtended Keccak Code Package, https://github.com/XKCP/XKCP) at what optimized implementations they have available.

I noticed they did have intrinsics-based implementations available for AVX2, but they compute e.g. Keccak-p1600 with 2, 4, or 8-way parallelism:

https://github.com/XKCP/XKCP/blob/716f007dd73ef28d357b8162173646be574ad1b7/lib/low/KeccakP-1600-times4/AVX2/KeccakP-1600-times4-AVX2.c

There also appears to be a non-parallel intrinsics implementation for AVX-512:

https://github.com/XKCP/XKCP/blob/716f007dd73ef28d357b8162173646be574ad1b7/lib/low/KeccakP-1600/AVX512/C/KeccakP-1600-AVX512.c

However, the non-parallel implementation for AVX2 is ASM-only:

https://github.com/XKCP/XKCP/blob/716f007dd73ef28d357b8162173646be574ad1b7/lib/low/KeccakP-1600/AVX2/KeccakP-1600-AVX2.s

See also the ARMv8 FEAT_SHA3 extensions: #93.

I'm not sure if this is because an intrinsics-based implementation doesn't make sense due to the need for a precisely designed register schedule, or because someone hasn't done the work yet to implement it.

[tarcieri]

I had started looking at porting the AVX2 ASM over from OpenSSL/CRYPTOGAMS in 2cc59ef however after staring at a bunch of ASM last week I think it'd be great if we could just use intrinsics instead as per #95.

There's this two-way parallel implementation here: https://github.com/XKCP/XKCP/blob/master/lib/low/KeccakP-1600-times2/SIMD128/KeccakP-1600-times2-SIMD128.c

For single-state we could do the same thing as the ARMv8 ASM does, which is effectively compute x2, then throw half away.

It should be a relatively straightforward, mostly mechanical translation from the C code of the sort we've done before.