4bdfaf469ed5a1194e0ec57ec7b1af73991a7ee3
3
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Filippo Valsorda
|
44a6062868 |
poly1305: add (*MAC).Verify API and use it in chacha20poly1305
Also, make sure New inlines so it does not cause an allocation. With this, we have a zero allocation poly1305 flow and a zero allocation generic chacha20poly1305 composition! \o/ While at it, remove some redundant code, and prepare to drop some complexity once the last assembly implementation of sum is dropped. Benchstat with "-tags purego" on amd64 name old time/op new time/op delta Open-64-8 461ns ± 2% 415ns ± 1% -9.93% (p=0.000 n=10+8) Seal-64-8 450ns ± 3% 412ns ± 3% -8.41% (p=0.000 n=10+10) Open-64-X-8 603ns ± 2% 544ns ± 2% -9.84% (p=0.000 n=10+10) Seal-64-X-8 580ns ± 3% 553ns ± 1% -4.56% (p=0.000 n=9+8) Open-1350-8 3.98µs ± 2% 3.65µs ± 2% -8.28% (p=0.000 n=9+10) Seal-1350-8 3.95µs ± 2% 3.64µs ± 1% -7.93% (p=0.000 n=9+10) Open-1350-X-8 4.06µs ± 1% 3.68µs ± 3% -9.31% (p=0.000 n=9+10) Seal-1350-X-8 4.08µs ± 4% 3.64µs ± 1% -10.71% (p=0.000 n=9+10) Open-8192-8 21.7µs ± 3% 18.9µs ± 2% -13.10% (p=0.000 n=9+10) Seal-8192-8 21.5µs ± 3% 18.8µs ± 1% -12.51% (p=0.000 n=9+9) Open-8192-X-8 21.4µs ± 1% 19.1µs ± 2% -10.88% (p=0.000 n=10+10) Seal-8192-X-8 21.3µs ± 2% 19.0µs ± 3% -10.92% (p=0.000 n=10+10) name old speed new speed delta Open-64-8 139MB/s ± 2% 154MB/s ± 2% +11.05% (p=0.000 n=10+8) Seal-64-8 142MB/s ± 3% 155MB/s ± 3% +9.11% (p=0.000 n=10+10) Open-64-X-8 106MB/s ± 2% 118MB/s ± 2% +10.93% (p=0.000 n=10+10) Seal-64-X-8 110MB/s ± 3% 116MB/s ± 1% +4.75% (p=0.000 n=9+8) Open-1350-8 339MB/s ± 2% 370MB/s ± 2% +9.04% (p=0.000 n=9+10) Seal-1350-8 342MB/s ± 2% 371MB/s ± 1% +8.60% (p=0.000 n=9+10) Open-1350-X-8 333MB/s ± 1% 367MB/s ± 3% +10.30% (p=0.000 n=9+10) Seal-1350-X-8 331MB/s ± 4% 371MB/s ± 2% +11.96% (p=0.000 n=9+10) Open-8192-8 377MB/s ± 3% 434MB/s ± 2% +15.07% (p=0.000 n=9+10) Seal-8192-8 381MB/s ± 3% 436MB/s ± 1% +14.29% (p=0.000 n=9+9) Open-8192-X-8 383MB/s ± 1% 429MB/s ± 2% +12.21% (p=0.000 n=10+10) Seal-8192-X-8 385MB/s ± 2% 432MB/s ± 3% +12.26% (p=0.000 n=10+10) name old alloc/op new alloc/op delta Open-64-8 96.0B ± 0% 0.0B -100.00% (p=0.000 n=10+10) Seal-64-8 96.0B ± 0% 0.0B -100.00% (p=0.000 n=10+10) Open-64-X-8 96.0B ± 0% 0.0B -100.00% (p=0.000 n=10+10) Seal-64-X-8 96.0B ± 0% 0.0B -100.00% (p=0.000 n=10+10) Open-1350-8 1.41kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Seal-1350-8 1.41kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Open-1350-X-8 1.41kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Seal-1350-X-8 1.41kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Open-8192-8 9.47kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Seal-8192-8 9.47kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Open-8192-X-8 9.47kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) Seal-8192-X-8 9.47kB ± 0% 0.00kB -100.00% (p=0.000 n=10+10) name old allocs/op new allocs/op delta Open-64-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-64-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Open-64-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-64-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Open-1350-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-1350-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Open-1350-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-1350-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Open-8192-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-8192-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Open-8192-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Seal-8192-X-8 1.00 ± 0% 0.00 -100.00% (p=0.000 n=10+10) Change-Id: I2c30ddc960a889b49c8ee8ff8073ffc4e75f43af Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206977 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Katie Hockman <katie@golang.org> |
||
|
Filippo Valsorda
|
2dbfe9001f |
poly1305: rewrite the Go implementation with 64-bit limbs
The new code is meant to be readable without external references for Poly1305, and explains the field logic. The generic code is now 30-50% faster on a Intel(R) Xeon(R) CPU E5-2690 v3 @ 2.60GHz, and even better on a 3.1 GHz i7 MacBook. name old time/op new time/op delta 64-48 126ns ± 0% 80ns ± 1% -36.24% (p=0.000 n=16+20) 1K-48 1.07µs ± 0% 0.81µs ± 2% -23.63% (p=0.000 n=19+20) 2M-48 2.07ms ± 0% 1.61ms ± 1% -22.31% (p=0.000 n=20+20) Write64-48 79.3ns ± 0% 58.0ns ± 1% -26.89% (p=0.000 n=20+19) Write1K-48 1.02µs ± 0% 0.79µs ± 1% -22.91% (p=0.000 n=19+19) Write2M-48 2.07ms ± 0% 1.61ms ± 2% -22.33% (p=0.000 n=17+20) name old speed new speed delta 64-48 508MB/s ± 0% 797MB/s ± 1% +56.95% (p=0.000 n=16+20) 1K-48 960MB/s ± 0% 1257MB/s ± 2% +30.94% (p=0.000 n=18+20) 2M-48 1.01GB/s ± 0% 1.30GB/s ± 1% +28.73% (p=0.000 n=20+20) Write64-48 807MB/s ± 0% 1104MB/s ± 1% +36.78% (p=0.000 n=18+19) Write1K-48 1.00GB/s ± 0% 1.30GB/s ± 1% +29.71% (p=0.000 n=18+19) Write2M-48 1.01GB/s ± 0% 1.31GB/s ± 2% +28.77% (p=0.000 n=17+20) The assembly is still 50-90% faster on the Xeon, 30-60% on the MacBook. The Go code does not use all the arithmetic tricks the assembly does, and it does not have access to the three operand wide shift instruction. name old time/op new time/op delta 64-48 80.3ns ± 1% 54.2ns ± 0% -32.50% (p=0.000 n=20+17) 1K-48 815ns ± 2% 446ns ± 1% -45.27% (p=0.000 n=20+20) 2M-48 1.61ms ± 1% 0.86ms ± 0% -46.54% (p=0.000 n=20+17) Write64-48 58.0ns ± 1% 34.0ns ± 0% -41.34% (p=0.000 n=19+20) Write1K-48 790ns ± 1% 427ns ± 0% -45.92% (p=0.000 n=19+17) Write2M-48 1.61ms ± 2% 0.86ms ± 0% -46.51% (p=0.000 n=20+20) name old speed new speed delta 64-48 797MB/s ± 1% 1180MB/s ± 0% +48.09% (p=0.000 n=20+19) 1K-48 1.26GB/s ± 2% 2.30GB/s ± 1% +82.71% (p=0.000 n=20+20) 2M-48 1.30GB/s ± 1% 2.44GB/s ± 0% +87.04% (p=0.000 n=20+17) Write64-48 1.10GB/s ± 1% 1.88GB/s ± 0% +70.52% (p=0.000 n=19+18) Write1K-48 1.30GB/s ± 1% 2.40GB/s ± 0% +84.84% (p=0.000 n=19+18) Write2M-48 1.31GB/s ± 2% 2.44GB/s ± 0% +86.93% (p=0.000 n=20+20) Hopefully this will also avoid the need for an arm64 implementation. Since now the Go and the amd64/ppc64le assembly use the same limb schedule, drop the assembly initialize and finalize implementations, and make the wrapper code match. It comes with a minor slowdown. name old time/op new time/op delta 64-48 50.3ns ± 0% 54.2ns ± 0% +7.73% (p=0.000 n=20+17) 1K-48 441ns ± 0% 446ns ± 1% +1.10% (p=0.000 n=19+20) 2M-48 860µs ± 0% 859µs ± 0% ~ (p=0.178 n=19+17) Write64-48 34.0ns ± 0% 34.0ns ± 0% ~ (all equal) Write1K-48 424ns ± 0% 427ns ± 0% +0.71% (p=0.000 n=17+17) Write2M-48 860µs ± 0% 859µs ± 0% -0.04% (p=0.000 n=19+20) name old speed new speed delta 64-48 1.27GB/s ± 0% 1.18GB/s ± 0% -7.20% (p=0.000 n=20+19) 1K-48 2.32GB/s ± 0% 2.30GB/s ± 1% -1.07% (p=0.000 n=18+20) 2M-48 2.44GB/s ± 0% 2.44GB/s ± 0% ~ (p=0.173 n=19+17) Write64-48 1.88GB/s ± 0% 1.88GB/s ± 0% +0.04% (p=0.000 n=19+18) Write1K-48 2.41GB/s ± 0% 2.40GB/s ± 0% -0.67% (p=0.000 n=19+18) Write2M-48 2.44GB/s ± 0% 2.44GB/s ± 0% +0.04% (p=0.000 n=19+20) Since poly1305/sum_generic.go was almost entirely rewritten, it's probably best reviewed on gitiles. This is the implementation published at https://blog.filippo.io/a-literate-go-implementation-of-poly1305/ Updates #31470 Change-Id: I74f9011d3ee317a43b05ae7f05d96081d08bffd3 Reviewed-on: https://go-review.googlesource.com/c/crypto/+/169037 Reviewed-by: Katie Hockman <katie@golang.org> |
||
 Andreas Auernhammer
|
c2843e01d9 |
poly1305: implement a subset of the hash.Hash interface
This CL adds the poly1305.MAC type which implements a subset of the hash.Hash interface. With MAC it is possible to compute an authentication tag of data without copying it into a single byte slice. This commit modifies the reference/generic and the AMD64 assembler but not the ARM/s390x implementation to support an io.Writer interface. Updates golang/go#25219 Change-Id: I7ee5a9eadd43387cf3cd887d734c625575eee47d Reviewed-on: https://go-review.googlesource.com/c/crypto/+/111335 Run-TryBot: Filippo Valsorda <filippo@golang.org> TryBot-Result: Gobot Gobot <gobot@golang.org> Reviewed-by: Filippo Valsorda <filippo@golang.org> |