eiac/crypto
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
1,153 Commits 11 Branches 57 Tags
7042ebcbe097f305ba3a93f9a22b4befa4b83d29
Commit Graph
42 Commits
Author SHA1 Message Date
Garrett Bodley 7eace71069 chacha20poly1305: Avo port of chacha20poly1305_amd64.s 
This implementation utilizes the same registers found in the reference
implementation, aiming to produce a minimal semantic diff between the
Avo-generated output and the original hand-written assembly.

To verify the Avo implementation, the reference and Avo-generated
assembly files are fed to `go tool asm`, capturing the debug output into
corresponding temp files. The debug output contains supplementary
metadata (line numbers, instruction offsets, and source file references)
that must be removed in order to obtain a semantic diff of the two
files. This is accomplished via a small utility script written in awk.

Parameter metadata not found in the reference assembly file has been
added, leading to a diff on the lines where those symbols are
referenced.

Commands used to verify Avo output:

GOROOT=$(go env GOROOT)
ASM_PATH="chacha20poly1305/chacha20poly1305_amd64.s"
REFERENCE="b2d3a6a4b4d36521cd7f653879cf6981e7c5c340"

go tool asm -o /dev/null -I "$GOROOT"/src/runtime -debug \
  <(git cat-file -p "$REFERENCE:$ASM_PATH") \
  > /tmp/reference.s

go tool asm -o /dev/null -I "$GOROOT"/src/runtime -debug \
  "$ASM_PATH" \
  > /tmp/avo.s

normalize(){
  awk '{
    $1=$2=$3="";
    print substr($0,4)
  }'
}

diff <(normalize < /tmp/reference.s) <(normalize < /tmp/avo.s)

155,157c155,157
< MOVQ dst(FP), DI
< MOVQ key+24(FP), R8
< MOVQ src+48(FP), SI
---
> MOVQ dst_base(FP), DI
> MOVQ key_base+24(FP), R8
> MOVQ src_base+48(FP), SI
159c159
< MOVQ ad+72(FP), CX
---
> MOVQ ad_base+72(FP), CX
4684,4686c4684,4686
< MOVQ dst(FP), DI
< MOVQ key+24(FP), R8
< MOVQ src+48(FP), SI
---
> MOVQ dst_base(FP), DI
> MOVQ key_base+24(FP), R8
> MOVQ src_base+48(FP), SI
4688c4688
< MOVQ ad+72(FP), CX
---
> MOVQ ad_base+72(FP), CX

Change-Id: Ia3a8e70b7440944ee739499c41ddceb70e054ef9
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/601442
Reviewed-by: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
 2024-09-04 20:35:14 +00:00
Filippo Valsorda a6a393ffd6 all: bump go.mod version and drop compatibility shims 
Also, remove the legacy import annotations.

Fixes golang/go#68147

Change-Id: Ibfcc9322f27224c0ba92ea42cd56912a7d8783fd
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/594256
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
Auto-Submit: Filippo Valsorda <filippo@golang.org>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Roland Shoemaker <roland@golang.org>
 2024-06-26 15:12:35 +00:00
Mauri de Souza Meneguzzo df0bc9e1bb chacha20poly1305: guard PSHUFB usage with GOAMD64_v2 
The PSHUFB instruction is part of SSE which is only v2+ but it is being
used without the GOAMD64_v2 guard.

The ROL macros were copied from CL 516859 that adds internal/chacha8rand.

Fixes golang/go#63871

Change-Id: I3c8ba75ff284cda4fc788885643246936e617b85
GitHub-Last-Rev: e235e8eae67f16b3a58817cfdff729693faf2665
GitHub-Pull-Request: golang/crypto#275
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/538786
Reviewed-by: Keith Randall <khr@google.com>
Run-TryBot: Mauri de Souza Meneguzzo <mauri870@gmail.com>
TryBot-Result: Gopher Robot <gobot@golang.org>
Reviewed-by: Keith Randall <khr@golang.org>
Reviewed-by: Russ Cox <rsc@golang.org>
 2023-11-07 22:36:17 +00:00
Dmitri Shuralyov 8779cbd1c9 all: update go directive to 1.18 
Done with:

go get go@1.18
go mod tidy
go fix ./...

Using go1.21.3.

Also update avo to v0.5.0 in the curve25519/internal/field/_asm module.
It's newer and produces no diff in the generated code.

For golang/go#60268.

Change-Id: I9bd771ee8561595d7f68aaca76df6e3e33d35013
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/534141
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
Auto-Submit: Dmitri Shuralyov <dmitshur@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@google.com>
 2023-10-11 22:02:22 +00:00
Russ Cox 04dced17f7 internal/subtle: rename to internal/alias 
This avoids an import conflict in code that needs to import
crypto/subtle as well.

CL 424194 does the same for the main repo.

Change-Id: Ic54cb62bbfdcf5c2cb6f15ac47075ee1c41981ad
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/424175
Reviewed-by: Cherry Mui <cherryyz@google.com>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Gopher Robot <gobot@golang.org>
Auto-Submit: Russ Cox <rsc@golang.org>
 2022-08-17 18:37:53 +00:00
Filippo Valsorda c084706c22 poly1305: deprecate public package 
Fixes golang/go#36646

Change-Id: Ic19dd2171c84472fc9d3f44803224b87fc5c0417
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/345649
Trust: Filippo Valsorda <filippo@golang.org>
Trust: Katie Hockman <katie@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Roland Shoemaker <roland@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2021-09-15 21:47:49 +00:00
Tobias Klauser cd7d49e622 all: add //go:build lines to assembly files 
For golang/go#41184

Change-Id: Ica67fdbf2745ad2eef63dbb9ef70136e9e6fd348
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/319469
Trust: Tobias Klauser <tobias.klauser@gmail.com>
Run-TryBot: Tobias Klauser <tobias.klauser@gmail.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2021-05-13 12:29:33 +00:00
Russ Cox 5ea612d1eb all: go fmt ./... 
Make all our package sources use Go 1.17 gofmt format
(adding //go:build lines).

Not strictly necessary but will avoid spurious changes
as files are edited.

Part of //go:build change (#41184).
See https://golang.org/design/draft-gobuild

Change-Id: I70526bf588bf4078887e567795867ece785d666b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/294415
Trust: Russ Cox <rsc@golang.org>
Run-TryBot: Russ Cox <rsc@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2021-02-20 03:31:48 +00:00
Tamir Duberstein be400aefbc all: build tags: appengine,!gccgo => purego,gc 
appengine is obsolete and superseded by purego, and gc is a more
precise tag for files that use gc-syntax assembly.

Change-Id: I716f59de772ebeee4adf4d2a432edf300122cef0
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/269920
Trust: Ian Lance Taylor <iant@golang.org>
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2020-12-03 16:30:18 +00:00
Filippo Valsorda 44a6062868 poly1305: add (*MAC).Verify API and use it in chacha20poly1305 
Also, make sure New inlines so it does not cause an allocation. With
this, we have a zero allocation poly1305 flow and a zero allocation
generic chacha20poly1305 composition! \o/

While at it, remove some redundant code, and prepare to drop some
complexity once the last assembly implementation of sum is dropped.

Benchstat with "-tags purego" on amd64

name              old time/op    new time/op    delta
Open-64-8         461ns ± 2%     415ns ± 1%    -9.93%  (p=0.000 n=10+8)
Seal-64-8         450ns ± 3%     412ns ± 3%    -8.41%  (p=0.000 n=10+10)
Open-64-X-8       603ns ± 2%     544ns ± 2%    -9.84%  (p=0.000 n=10+10)
Seal-64-X-8       580ns ± 3%     553ns ± 1%    -4.56%  (p=0.000 n=9+8)
Open-1350-8      3.98µs ± 2%    3.65µs ± 2%    -8.28%  (p=0.000 n=9+10)
Seal-1350-8      3.95µs ± 2%    3.64µs ± 1%    -7.93%  (p=0.000 n=9+10)
Open-1350-X-8    4.06µs ± 1%    3.68µs ± 3%    -9.31%  (p=0.000 n=9+10)
Seal-1350-X-8    4.08µs ± 4%    3.64µs ± 1%   -10.71%  (p=0.000 n=9+10)
Open-8192-8      21.7µs ± 3%    18.9µs ± 2%   -13.10%  (p=0.000 n=9+10)
Seal-8192-8      21.5µs ± 3%    18.8µs ± 1%   -12.51%  (p=0.000 n=9+9)
Open-8192-X-8    21.4µs ± 1%    19.1µs ± 2%   -10.88%  (p=0.000 n=10+10)
Seal-8192-X-8    21.3µs ± 2%    19.0µs ± 3%   -10.92%  (p=0.000 n=10+10)

name              old speed      new speed      delta
Open-64-8       139MB/s ± 2%   154MB/s ± 2%   +11.05%  (p=0.000 n=10+8)
Seal-64-8       142MB/s ± 3%   155MB/s ± 3%    +9.11%  (p=0.000 n=10+10)
Open-64-X-8     106MB/s ± 2%   118MB/s ± 2%   +10.93%  (p=0.000 n=10+10)
Seal-64-X-8     110MB/s ± 3%   116MB/s ± 1%    +4.75%  (p=0.000 n=9+8)
Open-1350-8     339MB/s ± 2%   370MB/s ± 2%    +9.04%  (p=0.000 n=9+10)
Seal-1350-8     342MB/s ± 2%   371MB/s ± 1%    +8.60%  (p=0.000 n=9+10)
Open-1350-X-8   333MB/s ± 1%   367MB/s ± 3%   +10.30%  (p=0.000 n=9+10)
Seal-1350-X-8   331MB/s ± 4%   371MB/s ± 2%   +11.96%  (p=0.000 n=9+10)
Open-8192-8     377MB/s ± 3%   434MB/s ± 2%   +15.07%  (p=0.000 n=9+10)
Seal-8192-8     381MB/s ± 3%   436MB/s ± 1%   +14.29%  (p=0.000 n=9+9)
Open-8192-X-8   383MB/s ± 1%   429MB/s ± 2%   +12.21%  (p=0.000 n=10+10)
Seal-8192-X-8   385MB/s ± 2%   432MB/s ± 3%   +12.26%  (p=0.000 n=10+10)

name              old alloc/op   new alloc/op   delta
Open-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-8         96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8       96.0B ± 0%      0.0B       -100.00%  (p=0.000 n=10+10)
Open-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-8      1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8    1.41kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-8      9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8    9.47kB ± 0%    0.00kB       -100.00%  (p=0.000 n=10+10)

name              old allocs/op  new allocs/op  delta
Open-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-8          1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-64-X-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-1350-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-8        1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Open-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)
Seal-8192-X-8      1.00 ± 0%      0.00       -100.00%  (p=0.000 n=10+10)

Change-Id: I2c30ddc960a889b49c8ee8ff8073ffc4e75f43af
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/206977
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-22 19:42:13 +00:00
Filippo Valsorda 0848c95719 chacha20poly1305: improve ExampleNewX 
The example was failing to direct users on what to do with the nonce,
which should be almost universally prepended to the ciphertext.

Also, leaving key out of the function was pulling the entire file into
the example.

Updates golang/go#38369

Change-Id: I3a13342fff02e1a5d6f9c4ef2a8bddf0b1097707
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/227937
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
 2020-04-14 17:38:20 +00:00
Filippo Valsorda 2aa609cf4a chacha20,poly1305,chacha20poly1305: set consistent build tags 
appengine was only necessary for the legacy system based on Go 1.9, drop
that. Add purego tags instead. Remove redundant architecture tags.

Change-Id: Ib1f65a4837511e63e08c1aa43163a79cfe868e0c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/215498
Run-TryBot: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Katie Hockman <katie@golang.org>
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
 2020-02-21 23:15:18 +00:00
Filippo Valsorda e0829623af chacha20: expose internal/chacha20 package 
const KeySize = 32
const NonceSize = 12
func HChaCha20(key, nonce []byte) ([]byte, error)
type Cipher struct {}
func NewUnauthenticatedCipher(key, nonce []byte) (*Cipher, error)
func (s *Cipher) XORKeyStream(dst, src []byte)

Small performance hit in chacha20poly1305, probably due to the loss
of the Advance API, which we might consider adding later. No new
allocations, thanks to the mid-stack inliner.

name                            old time/op    new time/op    delta
Chacha20Poly1305/Open-64-8        1.60µs ± 0%    1.68µs ± 1%  +4.94%  (p=0.000 n=9+10)
Chacha20Poly1305/Seal-64-8        1.56µs ± 0%    1.64µs ± 1%  +5.21%  (p=0.000 n=8+10)
Chacha20Poly1305/Open-64-X-8      2.10µs ± 1%    2.22µs ± 1%  +5.81%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-64-X-8      2.07µs ± 1%    2.17µs ± 0%  +4.88%  (p=0.000 n=10+10)
Chacha20Poly1305/Open-1350-8      15.4µs ± 0%    15.7µs ± 1%  +1.65%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-1350-8      15.6µs ± 2%    15.9µs ± 1%  +1.58%  (p=0.028 n=10+9)
Chacha20Poly1305/Open-1350-X-8    16.0µs ± 1%    16.3µs ± 2%  +2.00%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-1350-X-8    15.9µs ± 0%    16.3µs ± 1%  +1.91%  (p=0.000 n=10+8)
Chacha20Poly1305/Open-8192-8      85.6µs ± 0%    86.6µs ± 1%  +1.21%  (p=0.000 n=10+10)
Chacha20Poly1305/Seal-8192-8      85.7µs ± 0%    86.3µs ± 0%  +0.68%  (p=0.001 n=9+9)
Chacha20Poly1305/Open-8192-X-8    86.4µs ± 1%    87.1µs ± 1%  +0.76%  (p=0.035 n=10+9)
Chacha20Poly1305/Seal-8192-X-8    86.0µs ± 0%    87.0µs ± 1%  +1.14%  (p=0.000 n=9+9)

Updates golang/go#24485

Change-Id: I2ec2ef487a03f013049915d9063751c75a78408b
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/185980
Reviewed-by: Michael Munday <mike.munday@ibm.com>
 2019-11-11 21:38:06 +00:00
Neven Sajko 92d88b081a all: change the old assembly style AX:CX to CX, AX 
Assembly files with "/vendor/" or "testdata" in their paths were
ignored.

Change-Id: I10621751b5eb649d0737025f944d5955c9204376
GitHub-Last-Rev: 005e16566cbfb36ffb4f31e4138e963c5dbcc700
GitHub-Pull-Request: golang/crypto#83
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/170778
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2019-04-17 17:02:29 +00:00
Martin Möhrmann 614d502a4d chacha20poly1305: use x/sys/cpu feature variables directly 
Avoid using package specific variables when there is a one to one
correspondance to cpu feature support exported by internal/cpu.

This makes it clearer which cpu feature is referenced.
Another advantage is that internal/cpu variables are padded to avoid
false sharing and memory and cache usage is shared by multiple packages.

Change-Id: Ieadfc2f2f65f83f947aa8a5efc869aa85d89615d
Reviewed-on: https://go-review.googlesource.com/126597
Run-TryBot: Martin Möhrmann <moehrmann@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-08-20 15:07:26 +00:00
Adam Langley de07523181 chacha20poly1305: add some more XChaCha20-Poly1305 test vectors. 
These vectors were generated with libsodium to ensure that Go is
compatible with that library:

  #include <stdio.h>
  #include <sodium.h>
  #include <stdlib.h>

  static void hexdump(const uint8_t *in, size_t in_len) {
  	printf("\t\t\"");
  	for (size_t i = 0; i < in_len; i++) {
  		printf("%02x", in[i]);
  	}
  	printf("\",\n");
  }

  int main() {
  	uint8_t nonce[24];
  	uint8_t key[32];
  	uint8_t m[64], c[64+16];
  	uint8_t ad[16];

  	for (size_t ad_len = 0; ad_len < sizeof(ad); ad_len += 4) {
  		for (size_t m_len = 0; m_len < sizeof(m); m_len += 5) {
  			randombytes(nonce, sizeof(nonce));
  			randombytes(key, sizeof(key));
  			randombytes(m, m_len);
  			randombytes(ad, ad_len);

  			unsigned long long c_len = sizeof(c);
  			if (crypto_aead_xchacha20poly1305_ietf_encrypt(c, &c_len, m, m_len, ad, ad_len, NULL, nonce, key)) {
  				abort();
  			}

  			printf("\t{\n");
  			hexdump(m, m_len);
  			hexdump(ad, ad_len);
  			hexdump(key, sizeof(key));
  			hexdump(nonce, sizeof(nonce));
  			hexdump(c, c_len);
  			printf("\t},\n");
  		}
  	}

  	return 0;
  }

Change-Id: I4e9e4dc26e0e842c82319829599dbe48c331726f
Reviewed-on: https://go-review.googlesource.com/128615
Run-TryBot: Adam Langley <agl@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2018-08-08 21:18:26 +00:00
Filippo Valsorda 80fca2ff14 chacha20poly1305: add example for NewX 
Change-Id: I619e38a2c8629e851435299fa5204f5fd48a1d87
Reviewed-on: https://go-review.googlesource.com/128055
Reviewed-by: Adam Langley <agl@golang.org>
 2018-08-06 19:00:21 +00:00
Filippo Valsorda f792edd33d chacha20poly1305: add XChaCha20-Poly1305 
The XChaCha20 construction does not have an authoritative spec, but this
implementation is based on the following documents:

https://cr.yp.to/snuffle/xsalsa-20081128.pdf
https://download.libsodium.org/doc/secret-key_cryptography/aead.html
http://loup-vaillant.fr/tutorials/chacha20-design
https://tools.ietf.org/html/draft-paragon-paseto-rfc-00#section-7

Tested against the following implementations:

https://github.com/jedisct1/libsodium/blob/7cdf3f0e841/test/default/aead_xchacha20poly1305.c
https://git.kernel.org/pub/scm/linux/kernel/git/zx2c4/linux.git/diff/lib/zinc/selftest/chacha20poly1305.h?h=zinc
https://git.zx2c4.com/wireguard-go/tree/xchacha20poly1305/xchacha20.go

name                            time/op          speed
Chacha20Poly1305/Open-64-8         225ns ± 1%     283MB/s ± 1%
Chacha20Poly1305/Open-64-X-8       390ns ± 0%     164MB/s ± 0%
Chacha20Poly1305/Seal-64-8         222ns ± 0%     287MB/s ± 0%
Chacha20Poly1305/Seal-64-X-8       386ns ± 0%     165MB/s ± 1%
Chacha20Poly1305/Open-1350-8      1.12µs ± 1%    1.21GB/s ± 1%
Chacha20Poly1305/Open-1350-X-8    1.28µs ± 0%    1.05GB/s ± 0%
Chacha20Poly1305/Seal-1350-8      1.15µs ± 0%    1.17GB/s ± 0%
Chacha20Poly1305/Seal-1350-X-8    1.32µs ± 1%    1.02GB/s ± 0%
Chacha20Poly1305/Open-8192-8      5.53µs ± 0%    1.48GB/s ± 0%
Chacha20Poly1305/Open-8192-X-8    5.71µs ± 1%    1.44GB/s ± 1%
Chacha20Poly1305/Seal-8192-8      5.54µs ± 1%    1.48GB/s ± 1%
Chacha20Poly1305/Seal-8192-X-8    5.74µs ± 1%    1.43GB/s ± 1%

Updates golang/go#24485

Change-Id: Iea6f3b4c2be67f16f56720a200dcc895c0f9d520
Reviewed-on: https://go-review.googlesource.com/127819
Run-TryBot: Filippo Valsorda <filippo@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
 2018-08-06 17:10:22 +00:00
Filippo Valsorda 37a17fe027 internal/subtle: add Any/InexactOverlap (new package) and apply them across packages 
AnyOverlap and InexactOverlap implement checks for the aliasing
requirements defined by the crypto/cipher interfaces. Apply them to all
implementations as the actual requirement could be architecture-dependent
and user code should not rely on undefined behavior.

Updates golang/go#21624

Change-Id: I465de02fb3fec4e0c6f1fdee1ef6ae7ed5abff10
Reviewed-on: https://go-review.googlesource.com/112236
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-06-13 22:47:33 +00:00
Michael Munday 1a580b3eff chacha20poly1305: delete unused assembly functions 
These are triggering vet errors when vendored into std.

Change-Id: Ied8158941d176129c76509acff7314a6a483c9f9
Reviewed-on: https://go-review.googlesource.com/113176
Run-TryBot: Michael Munday <mike.munday@ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-05-15 00:15:09 +00:00
Michael Munday 94e3fad7f1 chacha20poly1305: add test for empty plaintext and additional data 
The code (especially assembly implementations) should be able to
handle this scenario.

Change-Id: I68c6a5b8a099a23a87bfcb5f7246a2134f82bb9e
Reviewed-on: https://go-review.googlesource.com/112977
Run-TryBot: Michael Munday <mike.munday@ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Filippo Valsorda <filippo@golang.org>
 2018-05-13 06:46:51 +00:00
Tom Thorogood 2c241ca304 chacha20poly1305: correct AVX2 feature detection 
CL 110355 switched out the adhoc cpu feature detection for x/sys/cpu, in
doing so the AVX2 check was broken. The assembly code uses MULX which is
part of BMI2.

Updates golang/go#24843

Change-Id: I4719b8ff3211eb1c823099512e593e540d6f3be8
GitHub-Last-Rev: 70542b53cd09fcae26c3579cd84bcee39a4b8a57
GitHub-Pull-Request: golang/crypto#44
Reviewed-on: https://go-review.googlesource.com/110796
Reviewed-by: Tobias Klauser <tobias.klauser@gmail.com>
 2018-05-02 12:12:36 +00:00
Andreas Auernhammer ae8bce0030 crypto/{blake2b,blake2s,argon2,chacha20poly1305}: replace CPU feature detection 
This change removes package specific CPU-feature detection code and
replaces it with x/sys/cpu.

Fixes golang/go#24843

Change-Id: I150dd7b3aeb8eef428c91f9b1df741ceb8a87a24
Reviewed-on: https://go-review.googlesource.com/110355
Run-TryBot: Ilya Tocar <ilya.tocar@intel.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-04-30 18:12:35 +00:00
Michael Munday 754cb46fa0 chacha20poly1305: update to use new ChaCha20 API 
Use the new streaming API introduced in CL 104856. Performance
change is negligible:

name                       old speed      new speed      delta
Chacha20Poly1305Open_64     131MB/s ± 2%   135MB/s ± 2%  +3.01%  (p=0.000 n=18+18)
Chacha20Poly1305Seal_64     137MB/s ± 2%   141MB/s ± 3%  +2.89%  (p=0.000 n=19+20)
Chacha20Poly1305Open_1350   305MB/s ± 3%   309MB/s ± 2%  +1.38%  (p=0.001 n=19+20)
Chacha20Poly1305Seal_1350   309MB/s ± 2%   311MB/s ± 2%  +0.74%  (p=0.032 n=19+18)
Chacha20Poly1305Open_8K     338MB/s ± 3%   340MB/s ± 2%    ~     (p=0.108 n=19+20)
Chacha20Poly1305Seal_8K     335MB/s ± 4%   342MB/s ± 2%  +1.96%  (p=0.000 n=19+19)

Change-Id: I2232c9d8d8431f30fb85b4b371d78a57e633283e
Reviewed-on: https://go-review.googlesource.com/108657
Run-TryBot: Michael Munday <mike.munday@ibm.com>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-04-26 23:00:03 +00:00
Han-Wen Nienhuys 49373064ff internal/chacha20: move up from chacha20poly1305/internal/chacha20 
This exposes the chacha20 stream cipher to the entire x/crypto
package, and in particular to the SSH package, which uses separate,
unauthenticated chacha20 encryption for packet lengths.

Change-Id: I0b705482128f0657c09292370f03d08b588f7fec
Reviewed-on: https://go-review.googlesource.com/87075
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2018-01-10 14:51:33 +00:00
Filippo Valsorda 74b34b9dd6 all: make overlap rules wording consistent 
Updates golang/go#21279

Change-Id: I686835c644f52e3d5ea2b7e6431ef096d188c19d
Reviewed-on: https://go-review.googlesource.com/61133
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2017-09-11 15:03:43 +00:00
Han-Wen Nienhuys 0fe963104e chacha20poly1305: fix style nits in variable names 
Change-Id: I3ac9dc7bf1c1c6ff39b3385cbf965dfb57f8327a
Reviewed-on: https://go-review.googlesource.com/43511
Reviewed-by: Ian Lance Taylor <iant@golang.org>
 2017-05-16 16:16:55 +00:00
Martin Möhrmann 12e9ca725d chacha20poly1305: add runtime internal independent cpu feature detection 
Change-Id: I150c5e0453b0fa3457d4786fe90901a54e216b02
Reviewed-on: https://go-review.googlesource.com/41862
Run-TryBot: Martin Möhrmann <moehrmann@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Keith Randall <khr@golang.org>
 2017-05-03 07:39:20 +00:00
Andreas Auernhammer 55a552f082 x/crypto/*: add import comment 
Add import comment for blake2b, blake2s, chacha20poly1305 and cryptobyte.

Change-Id: I4703b5cd669e43a5d81422b2ded8b8f54eee5f9b
Reviewed-on: https://go-review.googlesource.com/39952
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
 2017-04-07 17:36:45 +00:00
Michael Munday 854ae91cdc crypto/chacha20poly1305: rename test vectors file 
The previous name did not have the '_test.go' suffix and so was
always built.

Change-Id: I2d18d0ba5c863ac7f0dd0465ebafba4e022faa14
Reviewed-on: https://go-review.googlesource.com/35875
Run-TryBot: Michael Munday <munday@ca.ibm.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2017-01-26 20:06:16 +00:00
Michael Munday 33e8e8f6b3 crypto/chacha20poly1305/internal/chacha20: add missing copyright header 
The file was originally added in 2016.

Change-Id: I1b5c01400fb73e83f39c086ea1235a948d27308d
Reviewed-on: https://go-review.googlesource.com/35874
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2017-01-26 20:05:52 +00:00
Lion Yang cb497ae8f1 chacha20poly1305: fix detection of BMI on amd64 
This change detects BMI2 usability as an additional condition
to examine the usability of AVX2 version algorithm, fixes
the crash on the platfrom which supports AVX2 but not support BMI2.

Change-Id: I5438d4ec84265c79a51c1439265a33b1be04878a
Reviewed-on: https://go-review.googlesource.com/34852
Reviewed-by: Adam Langley <agl@golang.org>
Reviewed-by: Ian Lance Taylor <iant@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Ian Lance Taylor <iant@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2017-01-06 18:10:41 +00:00
Mikio Hara 2b786ab9e9 chacha20poly1305: fix typos 
Change-Id: I55a2ad4495f4e1164af6a8504b035cf658f8b822
Reviewed-on: https://go-review.googlesource.com/34536
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2016-12-19 15:50:45 +00:00
Mikio Hara a70a72a727 chacha20poly1305: fix typos 
Change-Id: Icf4ccb29e9eae0fb6fd237ca1d8785d4fd39a8d8
Reviewed-on: https://go-review.googlesource.com/34534
Run-TryBot: Mikio Hara <mikioh.mikioh@gmail.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2016-12-19 06:01:24 +00:00
Shenghou Ma 8a549a1948 chacha20poly1305: make polyHashADInternal private 
For golang/go#18154.

Change-Id: Ieab8bae9cb8be5e2817a87ae62ac0a2218f63dbb
Reviewed-on: https://go-review.googlesource.com/33855
Run-TryBot: Minux Ma <minux@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2016-12-02 06:00:03 +00:00
Alex Vaghin 9477e0b78b chacha20poly1305: fix build constraints 
Similarly to https://go-review.googlesource.com/32311,
chacha20poly1305 needs additional build constraints
for non-standard toolchains.

Change-Id: I22816ef333c05450e9ab4debb3ce591518b6b84b
Reviewed-on: https://go-review.googlesource.com/32391
Run-TryBot: Alex Vaghin <ddos@google.com>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
 2016-10-31 18:08:06 +00:00
Adam Langley 14f9af67c6 chacha20poly1305: scope assembly constants 
The names of the constant values were previously not scoped to the
package and |andMask| could collide with the variable of the same name
in the AES-GCM assembly.

Change-Id: I9387a6cace71a585ad2fe2afcc8436d44bde0917
Reviewed-on: https://go-review.googlesource.com/31265
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
 2016-10-17 20:27:11 +00:00
Andreas Auernhammer 5f4e837b98 chacha20poly1305: fix amd64 assembly - replace PINSRB and PEXTRQ 
The SSE code of chacha20poly1305 used PINSRB and PEXTRQ, which are only available
on machines supporting SSE4.1.

Fixes golang/go#17464

Change-Id: Ic7313433cb21f9a3709d23b50ab58ac1d87957af
Reviewed-on: https://go-review.googlesource.com/31187
Reviewed-by: Adam Langley <agl@golang.org>
Run-TryBot: Adam Langley <agl@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2016-10-17 00:19:40 +00:00
Adam Langley 1ed0c38df5 chacha20poly1305: clarify the correct attribution for the AMD64 assembly. 
I pushed from the wrong terminal when addressing the comments on
https://golang.org/cl/31256/

Change-Id: Ic75f8348294ed0e4f77a59de948096269a454bcb
Reviewed-on: https://go-review.googlesource.com/31256
Reviewed-by: Adam Langley <agl@golang.org>
 2016-10-16 19:04:44 +00:00
Adam Langley 6bcc37609f chacha20poly1305: clarify the correct attribution for the AMD64 assembly. 
Change-Id: I9c247e49a13788408b4fe49676520d608d8c4380
Reviewed-on: https://go-review.googlesource.com/31090
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
 2016-10-16 19:01:39 +00:00
Brad Fitzpatrick 5f31782cfb poly1305, chacha20poly1305: fix build for Go 1.6 
Fixes golang/go#17424

Change-Id: I49d6e475c173da6a31542931d555ab87cc45a1c6
Reviewed-on: https://go-review.googlesource.com/30971
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
Reviewed-by: Adam Langley <agl@golang.org>
 2016-10-12 22:20:46 +00:00
Adam Langley 594708b89f chacha20poly1305: new package. 
This change adds a package, chacha20poly1305, which implements the
ChaCha20-Poly1305 AEAD from RFC 7539. This AEAD has several attractive
features:
   1. It's naturally constant time. AES-GCM needs either dedicated
      hardware or extreme effort to be fast and constant-time, while
      this design is easy to make constant-time.
   2. It's fast on modern processors: it runs at 1GB/s on my IvyBrige
      system.
   3. It's seeing significant use in TLS. (A change for crypto/tls is
      forthcoming.)

This change merges two CLs:
  https://go-review.googlesource.com/#/c/24717
  https://go-review.googlesource.com/#/c/26691

I took the amd64-optimised AEAD implementation from the former because
it was significantly faster. But the structure of the change is taken
from the latter.

This version will be checked into x/crypto. This package will then be
vendored into the stdlib so that it can be used from crypto/tls.

Change-Id: I5a60587958b7afeec81ca1091e603a7e8517000b
Reviewed-on: https://go-review.googlesource.com/30728
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org>
Run-TryBot: Brad Fitzpatrick <bradfitz@golang.org>
TryBot-Result: Gobot Gobot <gobot@golang.org>
 2016-10-11 21:59:08 +00:00