linux-kernel - Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251205045849.GB6421@sol>
Date: Thu, 4 Dec 2025 20:58:49 -0800
From: Eric Biggers <ebiggers@...nel.org>
To: "Jason A. Donenfeld" <Jason@...c4.com>
Cc: linux-crypto@...r.kernel.org, linux-kernel@...r.kernel.org,
	Ard Biesheuvel <ardb@...nel.org>,
	Herbert Xu <herbert@...dor.apana.org.au>,
	Thorsten Blum <thorsten.blum@...ux.dev>,
	Nathan Chancellor <nathan@...nel.org>,
	Nick Desaulniers <nick.desaulniers+lkml@...il.com>,
	Bill Wendling <morbo@...gle.com>,
	Justin Stitt <justinstitt@...gle.com>,
	David Laight <david.laight@...box.com>,
	David Sterba <dsterba@...e.com>, llvm@...ts.linux.dev,
	linux-btrfs@...r.kernel.org
Subject: Re: [PATCH] lib/crypto: blake2b: Roll up BLAKE2b round loop on 32-bit

On Thu, Dec 04, 2025 at 12:56:32PM -0500, Jason A. Donenfeld wrote:
> On Wed, Dec 03, 2025 at 11:06:52AM -0800, Eric Biggers wrote:
> >  	G(r, 4, v[0], v[ 5], v[10], v[15]); \
> >  	G(r, 5, v[1], v[ 6], v[11], v[12]); \
> >  	G(r, 6, v[2], v[ 7], v[ 8], v[13]); \
> >  	G(r, 7, v[3], v[ 4], v[ 9], v[14]); \
> >  } while (0)
> > -		ROUND(0);
> > -		ROUND(1);
> > -		ROUND(2);
> > -		ROUND(3);
> > -		ROUND(4);
> > -		ROUND(5);
> > -		ROUND(6);
> > -		ROUND(7);
> > -		ROUND(8);
> > -		ROUND(9);
> > -		ROUND(10);
> > -		ROUND(11);
> > +
> > +#ifdef CONFIG_64BIT
> > +		/*
> > +		 * Unroll the rounds loop to enable constant-folding of the
> > +		 * blake2b_sigma values.  Seems worthwhile on 64-bit kernels.
> > +		 * Not worthwhile on 32-bit kernels because the code size is
> > +		 * already so large there due to BLAKE2b using 64-bit words.
> > +		 */
> > +		unrolled_full
> > +#endif
> > +		for (int r = 0; r < 12; r++)
> > +			ROUND(r);
> >  
> >  #undef G
> >  #undef ROUND
> 
> Since you're now using `unrolled_full`, ROUND doesn't need to be a macro
> anymore. You can just do:
> 
>   unrolled_full
>   for (int r = 0; r < 12; r++) {
>     G(r, 0, v[0], v[ 4], v[ 8], v[12]);
>     G(r, 1, v[1], v[ 5], v[ 9], v[13]);
>     G(r, 2, v[2], v[ 6], v[10], v[14]);
>     G(r, 3, v[3], v[ 7], v[11], v[15]);
>     G(r, 4, v[0], v[ 5], v[10], v[15]);
>     G(r, 5, v[1], v[ 6], v[11], v[12]);
>     G(r, 6, v[2], v[ 7], v[ 8], v[13]);
>     G(r, 7, v[3], v[ 4], v[ 9], v[14]);
>   }
> 
> Likewise, you can simplify the blake2s implementation in the same way
> (but don't make the unrolled_full conditional there, obviously).
> `unrolled_full` seems like a nice way of doing this compared to macros.

Yes, good idea.  I'll do that.

- Eric