# PolyXOR128

A 128-bit universal hash function for fast file and data-stream integrity checks with cryptographic strength, formally proven in Lean to have a low collision rate and reaching up to 130 GB/s on modern desktop CPUs.

PolyXOR128 is a 128-bit universal hash function designed for fast file and data-stream integrity checks with cryptographic-strength collision resistance. When initialized with a random key independent of the input, its collision probability for two inputs of up to n bytes is mathematically proven, and formalized in Lean, to be at most a small constant divided by 2^128.

It processes 128-byte blocks, adds key material, splits the result into five parts computed with a parity-check code, hashes each part with a carryless-multiplication variant of the NH construction similar to CLHASH, and accumulates the five hashes with XOR in SIMD, continuing until a 4 KiB buffer of key material is exhausted before recombining into a final polynomial hash. It reaches up to about 130 GB/s on a Ryzen 9950X and 60 GB/s on an Apple M2 Pro, with dynamic dispatch to hardware-accelerated carryless-multiplication paths on AArch64 and x86-64.

It needs hardware-accelerated carryless multiplication to reach its stated speed; the portable reference implementation is much slower, and a key-expanded instance uses about 5 KB of memory.

Website: https://github.com/orlp/polyxor