linux-kernel - Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20251205201411.GA1954@quark>
Date: Fri, 5 Dec 2025 12:14:11 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: david laight <david.laight@...box.com>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ard Biesheuvel <ardb@...nel.org>,
	"Jason A . Donenfeld" <Jason@...c4.com>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Thorsten Blum <thorsten.blum@...ux.dev>,
	Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	David Sterba <dsterba@...e.com>, llvm@...ts.linux.dev,
	linux-btrfs@...r.kernel.org
Subject: Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

On Fri, Dec 05, 2025 at 02:16:44PM +0000, david laight wrote:
> Note that executing two G() in parallel probably requires the source
> interleave the instructions for the two G() rather than relying on the
> cpu's 'out of order execution' to do all the work
> (Intel cpu might manage it...).

I actually tried that earlier, and it didn't help.  Either the compiler
interleaved the calculations already, or the CPU did, or both.

It definitely could use some more investigation to better understand
exactly what is going on, though.

You're welcome to take a closer look, if you're interested.

- Eric