linux-kernel - Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aTHLUIjqCHlRs8rr@zx2c4.com>
Date: Thu, 4 Dec 2025 12:56:32 -0500
From: "Jason A. Donenfeld" <Jason@...c4.com>
To: Eric Biggers <ebiggers@...nel.org>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ard Biesheuvel <ardb@...nel.org>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Thorsten Blum <thorsten.blum@...ux.dev>,
	Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	David Laight <david.laight@...box.com>,
	David Sterba <dsterba@...e.com>, llvm@...ts.linux.dev,
	linux-btrfs@...r.kernel.org
Subject: Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

On Wed, Dec 03, 2025 at 11:06:52AM -0800, Eric Biggers wrote:
>  	G(r, 4, v[0], v[ 5], v[10], v[15]); \
>  	G(r, 5, v[1], v[ 6], v[11], v[12]); \
>  	G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
>  	G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
>  } while (0)
> -		ROUND(0);
> -		ROUND(1);
> -		ROUND(2);
> -		ROUND(3);
> -		ROUND(4);
> -		ROUND(5);
> -		ROUND(6);
> -		ROUND(7);
> -		ROUND(8);
> -		ROUND(9);
> -		ROUND(10);
> -		ROUND(11);
> +
> +#ifdef CONFIG_64BIT
> +		/*
> +		 * Unroll the rounds loop to enable constant-folding of the
> +		 * blake2b_sigma values.  Seems worthwhile on 64-bit kernels.
> +		 * Not worthwhile on 32-bit kernels because the code size is
> +		 * already so large there due to BLAKE2b using 64-bit words.
> +		 */
> +		unrolled_full
> +#endif
> +		for (int r = 0; r < 12; r++)
> +			ROUND(r);
>  
>  #undef G
>  #undef ROUND

Since you're now using `unrolled_full`, ROUND doesn't need to be a macro
anymore. You can just do:

  unrolled_full
  for (int r = 0; r < 12; r++) {
    G(r, 0, v[0], v[ 4], v[ 8], v[12]);
    G(r, 1, v[1], v[ 5], v[ 9], v[13]);
    G(r, 2, v[2], v[ 6], v[10], v[14]);
    G(r, 3, v[3], v[ 7], v[11], v[15]);
    G(r, 4, v[0], v[ 5], v[10], v[15]);
    G(r, 5, v[1], v[ 6], v[11], v[12]);
    G(r, 6, v[2], v[ 7], v[ 8], v[13]);
    G(r, 7, v[3], v[ 4], v[ 9], v[14]);
  }

Likewise, you can simplify the blake2s implementation in the same way
(but don't make the unrolled_full conditional there, obviously).
`unrolled_full` seems like a nice way of doing this compared to macros.

Jason