Ctr_of: avoid big copy

[reynir]

Benchmark shows great improvement on longer strings. The benchmark does not test misaligned input.

reynir@solsort:~/workspace/mirage-crypto$ dune exec -- bench/speed.exe aes-128-ctr # before
accel: XOR AES GHASH                  

* [aes-128-ctr]
       16:  364.480883 MB/s  (47623923 iters in 1.994 s)
       64:  1118.507467 MB/s  (36657630 iters in 2.000 s)
      256:  2947.438690 MB/s  (24217854 iters in 2.006 s)
     1024:  3661.094800 MB/s  (7454258 iters in 1.988 s)
     8192:  1845.382352 MB/s  (467102 iters in 1.977 s)
reynir@solsort:~/workspace/mirage-crypto$ dune exec -- bench/speed.exe aes-128-ctr # after
accel: XOR AES GHASH                  

* [aes-128-ctr]
       16:  387.371435 MB/s  (50489623 iters in 1.989 s)
       64:  1215.338462 MB/s  (40128169 iters in 2.015 s)
      256:  3077.790823 MB/s  (25244779 iters in 2.003 s)
     1024:  4005.401860 MB/s  (8227947 iters in 2.006 s)
     8192:  2742.714636 MB/s  (711361 iters in 2.026 s)

[reynir]

With unaligned sizes (by adding one to each size in the benchmark) this is much slower for shorter inputs.

reynir@solsort:~/workspace/mirage-crypto$ dune exec -- bench/speed.exe aes-128-ctr # before
accel: XOR AES GHASH                  

* [aes-128-ctr]
       17:  337.795570 MB/s  (41769087 iters in 2.005 s)
       65:  1010.334267 MB/s  (32618179 iters in 2.001 s)
      257:  2586.241662 MB/s  (21106998 iters in 2.000 s)
     1025:  3487.418627 MB/s  (7132743 iters in 1.999 s)
     8193:  1824.102414 MB/s  (469460 iters in 2.011 s)
reynir@solsort:~/workspace/mirage-crypto$ dune exec -- bench/speed.exe aes-128-ctr # after
accel: XOR AES GHASH                   

* [aes-128-ctr]
       17:  237.812514 MB/s  (29331792 iters in 2.000 s)
       65:  789.692564 MB/s  (25467779 iters in 1.999 s)
      257:  2271.621332 MB/s  (18551774 iters in 2.002 s)
     1025:  3649.725516 MB/s  (7493078 iters in 2.007 s)
     8193:  2679.428875 MB/s  (682177 iters in 1.989 s)