mbox series

[crypto-next,v6,0/3] crypto: poly1305 improvements

Message ID 20191217174445.188216-1-Jason@zx2c4.com
Headers show
Series crypto: poly1305 improvements | expand

Message

Jason A. Donenfeld Dec. 17, 2019, 5:44 p.m. UTC
With no feedback on v5 beyond the need for a .gitignore in the second
commit of this v6, I think this series should now be good to go.

These are some improvements to the Poly1305 code that I think should be
fairly uncontroversial. The first part, the new C implementations, adds
cleaner code in two forms that can easily be compared and reviewed, and
also results in performance speedups. The second part, the new x86_64
implementation, replaces an slow unvetted implementation with an
extremely fast implementation that has received many eyeballs. Finally,
we fix up some deadcode.

Cc: Eric Biggers <ebiggers@kernel.org>
Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>

Jason A. Donenfeld (3):
  crypto: poly1305 - add new 32 and 64-bit generic versions
  crypto: x86_64/poly1305 - add faster implementations
  crypto: arm/arm64/mips/poly1305 - remove redundant non-reduction from
    emit

 arch/arm/crypto/poly1305-glue.c        |   18 +-
 arch/arm64/crypto/poly1305-glue.c      |   18 +-
 arch/mips/crypto/poly1305-glue.c       |   18 +-
 arch/x86/crypto/.gitignore             |    1 +
 arch/x86/crypto/Makefile               |   11 +-
 arch/x86/crypto/poly1305-avx2-x86_64.S |  390 ---
 arch/x86/crypto/poly1305-sse2-x86_64.S |  590 ----
 arch/x86/crypto/poly1305-x86_64.pl     | 4266 ++++++++++++++++++++++++
 arch/x86/crypto/poly1305_glue.c        |  308 +-
 crypto/adiantum.c                      |    4 +-
 crypto/nhpoly1305.c                    |    2 +-
 crypto/poly1305_generic.c              |   27 +-
 include/crypto/internal/poly1305.h     |   50 +-
 include/crypto/nhpoly1305.h            |    4 +-
 include/crypto/poly1305.h              |   16 +-
 lib/crypto/Kconfig                     |    4 +-
 lib/crypto/Makefile                    |    4 +-
 lib/crypto/poly1305-donna32.c          |  204 ++
 lib/crypto/poly1305-donna64.c          |  185 +
 lib/crypto/poly1305.c                  |  174 +-
 20 files changed, 4927 insertions(+), 1367 deletions(-)
 create mode 100644 arch/x86/crypto/.gitignore
 delete mode 100644 arch/x86/crypto/poly1305-avx2-x86_64.S
 delete mode 100644 arch/x86/crypto/poly1305-sse2-x86_64.S
 create mode 100644 arch/x86/crypto/poly1305-x86_64.pl
 create mode 100644 lib/crypto/poly1305-donna32.c
 create mode 100644 lib/crypto/poly1305-donna64.c

-- 
2.24.1

Comments

Eric Biggers Dec. 18, 2019, 2:48 a.m. UTC | #1
On Tue, Dec 17, 2019 at 06:44:42PM +0100, Jason A. Donenfeld wrote:
> With no feedback on v5 beyond the need for a .gitignore in the second

> commit of this v6, I think this series should now be good to go.


Well, you've also sent 6 versions of this patchset in less than a week, so I'm
not sure people have had enough time to review it.  I've just left a few
comments for things I noticed in a quick read-through.

That being said, I don't think anyone plans to review the 4200 lines of assembly
code anyway (which even the other OpenSSL developers don't understand [1]), so
maybe it doesn't matter.

[1] https://github.com/openssl/openssl/pull/2056#pullrequestreview-12242604

- Eric