Filippo Valsorda
750a45fe5e
sha3: add MarshalBinary, AppendBinary, and UnmarshalBinary
...
Fixes golang/go#24617
Change-Id: I1d9d529950aa8a5953435e8d3412cda44b075d55
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/616635
Reviewed-by: Roland Shoemaker <roland@golang.org >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net >
Reviewed-by: Michael Pratt <mpratt@google.com >
2024-10-22 19:51:02 +00:00
Filippo Valsorda
36b172546b
sha3: avoid trailing permutation
...
If you read a multiple of the rate, and then stop, there is no point in
running the final permutation.
Change-Id: Ic95e70f78b6e139aca1d3e3c11e09d2bbcf54f6c
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/620555
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net >
Reviewed-by: Roland Shoemaker <roland@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Michael Pratt <mpratt@google.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
2024-10-22 19:50:23 +00:00
Filippo Valsorda
c17aa50fbd
sha3: avoid buffer copy
...
Previously, the package worked by copying the input (or the output) into
a buffer, and then XOR'ing (or copying) it into (or out of) the state.
(Except for an input fast path.) There's no need for that! We can XOR
straight into the state, and copy straight out of it, at least on little
endian machines. This is a bit faster, almost halves the state size, and
will make it easier to implement marshaling, but most importantly look
at how much simpler it makes the code!
go: go1.23.0
goos: linux
goarch: amd64
pkg: golang.org/x/crypto/sha3
cpu: AMD Ryzen 7 PRO 8700GE w/ Radeon 780M Graphics
│ v0.27.0-2-g42ee18b9637 │ v0.27.0-2-g42ee18b9637-dirty │
│ sec/op │ sec/op vs base │
PermutationFunction-8 270.8n ± 0% 270.4n ± 0% ~ (p=0.099 n=10)
Sha3_512_MTU-8 5.762µ ± 0% 5.658µ ± 0% -1.80% (p=0.000 n=10)
Sha3_384_MTU-8 4.179µ ± 0% 4.070µ ± 0% -2.60% (p=0.000 n=10)
Sha3_256_MTU-8 3.316µ ± 0% 3.214µ ± 0% -3.08% (p=0.000 n=10)
Sha3_224_MTU-8 3.175µ ± 0% 3.061µ ± 0% -3.61% (p=0.000 n=10)
Shake128_MTU-8 2.779µ ± 0% 2.681µ ± 0% -3.51% (p=0.000 n=10)
Shake256_MTU-8 2.947µ ± 0% 2.957µ ± 0% +0.32% (p=0.000 n=10)
Shake256_16x-8 44.15µ ± 0% 44.45µ ± 0% +0.67% (p=0.000 n=10)
Shake256_1MiB-8 2.319m ± 0% 2.274m ± 0% -1.93% (p=0.000 n=10)
Sha3_512_1MiB-8 4.204m ± 0% 4.219m ± 0% +0.34% (p=0.000 n=10)
geomean 13.75µ 13.54µ -1.55%
│ v0.27.0-2-g42ee18b9637 │ v0.27.0-2-g42ee18b9637-dirty │
│ B/s │ B/s vs base │
PermutationFunction-8 704.3Mi ± 0% 705.4Mi ± 0% ~ (p=0.105 n=10)
Sha3_512_MTU-8 223.5Mi ± 0% 227.6Mi ± 0% +1.83% (p=0.000 n=10)
Sha3_384_MTU-8 308.1Mi ± 0% 316.4Mi ± 0% +2.67% (p=0.000 n=10)
Sha3_256_MTU-8 388.2Mi ± 0% 400.5Mi ± 0% +3.17% (p=0.000 n=10)
Sha3_224_MTU-8 405.5Mi ± 0% 420.7Mi ± 0% +3.73% (p=0.000 n=10)
Shake128_MTU-8 463.4Mi ± 0% 480.2Mi ± 0% +3.64% (p=0.000 n=10)
Shake256_MTU-8 436.9Mi ± 0% 435.5Mi ± 0% -0.32% (p=0.000 n=10)
Shake256_16x-8 353.9Mi ± 0% 351.5Mi ± 0% -0.66% (p=0.000 n=10)
Shake256_1MiB-8 431.2Mi ± 0% 439.7Mi ± 0% +1.97% (p=0.000 n=10)
Sha3_512_1MiB-8 237.8Mi ± 0% 237.1Mi ± 0% -0.33% (p=0.000 n=10)
geomean 375.7Mi 381.6Mi +1.57%
Even stronger effect when patched on top of CL 616555 (forced on).
go: go1.23.0
goos: darwin
goarch: arm64
pkg: golang.org/x/crypto/sha3
cpu: Apple M2
│ old │ new │
│ sec/op │ sec/op vs base │
PermutationFunction-8 154.7n ± 2% 153.8n ± 1% ~ (p=0.469 n=10)
Sha3_512_MTU-8 3.260µ ± 2% 3.143µ ± 2% -3.60% (p=0.000 n=10)
Sha3_384_MTU-8 2.389µ ± 2% 2.244µ ± 2% -6.07% (p=0.000 n=10)
Sha3_256_MTU-8 1.950µ ± 2% 1.758µ ± 1% -9.87% (p=0.000 n=10)
Sha3_224_MTU-8 1.874µ ± 2% 1.686µ ± 1% -10.06% (p=0.000 n=10)
Shake128_MTU-8 1.827µ ± 3% 1.447µ ± 1% -20.80% (p=0.000 n=10)
Shake256_MTU-8 1.665µ ± 3% 1.604µ ± 3% -3.63% (p=0.003 n=10)
Shake256_16x-8 25.14µ ± 1% 25.23µ ± 2% ~ (p=0.912 n=10)
Shake256_1MiB-8 1.236m ± 2% 1.243m ± 2% ~ (p=0.631 n=10)
Sha3_512_1MiB-8 2.296m ± 2% 2.305m ± 1% ~ (p=0.315 n=10)
geomean 7.906µ 7.467µ -5.56%
│ old │ new │
│ B/op │ B/op vs base │
PermutationFunction-8 1.204Gi ± 2% 1.212Gi ± 1% ~ (p=0.529 n=10)
Sha3_512_MTU-8 394.9Mi ± 2% 409.7Mi ± 2% +3.73% (p=0.000 n=10)
Sha3_384_MTU-8 539.0Mi ± 2% 573.8Mi ± 2% +6.45% (p=0.000 n=10)
Sha3_256_MTU-8 660.3Mi ± 2% 732.6Mi ± 1% +10.95% (p=0.000 n=10)
Sha3_224_MTU-8 687.1Mi ± 2% 763.9Mi ± 1% +11.17% (p=0.000 n=10)
Shake128_MTU-8 704.7Mi ± 2% 889.6Mi ± 2% +26.24% (p=0.000 n=10)
Shake256_MTU-8 773.4Mi ± 3% 802.5Mi ± 3% +3.76% (p=0.004 n=10)
Shake256_16x-8 621.6Mi ± 1% 619.3Mi ± 2% ~ (p=0.912 n=10)
Shake256_1MiB-8 809.1Mi ± 2% 804.7Mi ± 2% ~ (p=0.631 n=10)
Sha3_512_1MiB-8 435.6Mi ± 2% 433.9Mi ± 1% ~ (p=0.315 n=10)
geomean 653.6Mi 692.0Mi +5.88%
Change-Id: I33a0a1ddf305c395f99bf17f81473e2f42c5ce42
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/616575
Reviewed-by: Daniel McCarney <daniel@binaryparadox.net >
Reviewed-by: Michael Pratt <mpratt@google.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Andrew Ekstedt <andrew.ekstedt@gmail.com >
2024-10-21 19:02:20 +00:00
Filippo Valsorda
477a5b4c32
sha3: make APIs usable with zero allocations
...
The "buf points into storage" pattern is nice, but causes the whole
state struct to escape, since escape analysis can't track the pointer
once it's assigned to buf.
Change-Id: I31c0e83f946d66bedb5a180e96ab5d5e936eb322
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/544817
Reviewed-by: Cherry Mui <cherryyz@google.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Mauri de Souza Meneguzzo <mauri870@gmail.com >
Auto-Submit: Filippo Valsorda <filippo@golang.org >
2024-05-07 22:04:09 +00:00
Filippo Valsorda
10f366e7a2
sha3: simplify XOR functions
...
name old time/op new time/op delta
PermutationFunction-4 398ns ± 0% 399ns ± 1% ~ (p=0.508 n=9+10)
Sha3_512_MTU-4 8.34µs ± 1% 8.36µs ± 1% ~ (p=0.101 n=10+10)
Sha3_384_MTU-4 6.00µs ± 0% 6.02µs ± 1% +0.47% (p=0.000 n=8+10)
Sha3_256_MTU-4 4.78µs ± 0% 4.79µs ± 1% ~ (p=0.324 n=10+10)
Sha3_224_MTU-4 4.57µs ± 1% 4.57µs ± 1% ~ (p=0.288 n=10+10)
Shake128_MTU-4 3.87µs ± 0% 3.86µs ± 1% -0.22% (p=0.008 n=9+9)
Shake256_MTU-4 4.17µs ± 0% 4.17µs ± 0% ~ (p=0.474 n=10+8)
Shake256_16x-4 59.4µs ± 0% 59.7µs ± 0% +0.48% (p=0.000 n=9+8)
Shake256_1MiB-4 3.19ms ± 1% 3.20ms ± 0% ~ (p=0.105 n=10+10)
Sha3_512_1MiB-4 5.97ms ± 0% 6.01ms ± 0% +0.75% (p=0.000 n=10+10)
name old speed new speed delta
PermutationFunction-4 502MB/s ± 0% 502MB/s ± 0% ~ (p=0.497 n=9+10)
Sha3_512_MTU-4 162MB/s ± 1% 161MB/s ± 1% ~ (p=0.101 n=10+10)
Sha3_384_MTU-4 225MB/s ± 0% 224MB/s ± 1% -0.47% (p=0.000 n=8+10)
Sha3_256_MTU-4 282MB/s ± 0% 282MB/s ± 1% ~ (p=0.325 n=10+10)
Sha3_224_MTU-4 296MB/s ± 1% 295MB/s ± 1% ~ (p=0.280 n=10+10)
Shake128_MTU-4 349MB/s ± 0% 350MB/s ± 1% +0.22% (p=0.008 n=9+9)
Shake256_MTU-4 324MB/s ± 0% 324MB/s ± 0% ~ (p=0.459 n=10+8)
Shake256_16x-4 276MB/s ± 0% 274MB/s ± 0% -0.48% (p=0.000 n=9+8)
Shake256_1MiB-4 328MB/s ± 1% 327MB/s ± 0% ~ (p=0.105 n=10+10)
Sha3_512_1MiB-4 176MB/s ± 0% 174MB/s ± 0% -0.74% (p=0.000 n=10+10)
Change-Id: Ib8e571f3c9a0f84096df2f38ca96da197ad5be30
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/544815
Auto-Submit: Filippo Valsorda <filippo@golang.org >
Reviewed-by: Roland Shoemaker <roland@golang.org >
Reviewed-by: Cherry Mui <cherryyz@google.com >
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Mauri de Souza Meneguzzo <mauri870@gmail.com >
2024-05-06 15:29:57 +00:00
Matthew Dempsky
3f0842a464
sha3: have ShakeHash extend hash.Hash
...
Package sha3 recommends the SHAKE functions for new uses, but this is
currently somewhat inconvenient because ShakeHash does not implement
hash.Hash. This is understandable, as SHAKE supports arbitrary-length
outputs whereas hash.Hash only supports fixed-length outputs. But
there's a natural fixed-length output to provide: the minimum output
that still provides SHAKE's full-strength generic security.
While here, tweak Sum so that its temporary buffer can be stack
allocated.
Also, tweak the panic message in Write so that the error text is more
readily understandable to Go programmers without needing to be
familiar with crypto jargon, and add a similar check in Sum.
Change-Id: Icf037d3990a71de5630f8825606614443f8c5245
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/526937
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com >
Reviewed-by: Adam Langley <agl@google.com >
Auto-Submit: Matthew Dempsky <mdempsky@google.com >
2023-09-10 18:25:15 +00:00
HowJmay
2f5cac09c9
acme, sha3, ssh: fix the typos
...
Change-Id: I2287ab3492c105791b03f40d45b5dff5a56aa32a
GitHub-Last-Rev: 02cdf82d8b1604fc47b656172b102a48a70e6f05
GitHub-Pull-Request: golang/crypto#183
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/319269
Trust: Alberto Donizetti <alb.donizetti@gmail.com >
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org >
2022-02-09 15:53:12 +00:00
Bryan C. Mills
c7e5f84aec
sha3: align (*state).storage
...
Even on platforms that allow unaligned reads, the Go runtime assumes
that a pointer to a given type has the alignment required by that
type.
Fixes golang/go#35173
Updates golang/go#34972
Updates golang/go#34964
Change-Id: I90361e096e59162e42ebde2914985af92f777ece
Reviewed-on: https://go-review.googlesource.com/c/crypto/+/203837
Run-TryBot: Bryan C. Mills <bcmills@google.com >
TryBot-Result: Gobot Gobot <gobot@golang.org >
Reviewed-by: Filippo Valsorda <filippo@golang.org >
2019-11-05 03:41:35 +00:00
Michael Munday
81e90905da
sha3: delete unused field
...
Change-Id: I7dcb8a5ee07cc39e0c503f211f8f77732f006ad6
Reviewed-on: https://go-review.googlesource.com/59170
Run-TryBot: Michael Munday <mike.munday@ibm.com >
TryBot-Result: Gobot Gobot <gobot@golang.org >
Reviewed-by: Brad Fitzpatrick <bradfitz@golang.org >
2017-08-25 22:01:21 +00:00
Martin Hamrle
077efaa604
x/crypto: fix typos
...
The typos were found by misspell tool.
Change-Id: I120740f12f7ba48330749ebf84050a7b98e01016
Reviewed-on: https://go-review.googlesource.com/24725
Reviewed-by: Ian Lance Taylor <iant@golang.org >
Run-TryBot: Ian Lance Taylor <iant@golang.org >
2016-07-06 16:40:51 +00:00
David Leon Gil
4ed45ec682
sha3: use unaligned reads and xors on x86 and x64
...
Speedup of about 1.4x on x64. Added benchmarks that use the
ShakeHash interface, which doesn't require copying the state.
Unaligned or generic xorIn and copyOut functions chosen via
buildline, but both are tested.
Substantial contributions from Eric Eisner.
See golang.org/cl/151630044 for the previous CR.
(There are also some minor edits/additions to the documentation.)
Change-Id: I9500c25682457c82487512b9b8c66df7d75bff5d
Reviewed-on: https://go-review.googlesource.com/2132
Reviewed-by: Adam Langley <agl@golang.org >
2015-01-12 22:01:33 +00:00
David Leon Gil
1b32d8b50a
go.crypto/sha3: update to sync with draft FIPS-202
...
1. API:
This exposes a minimal API: the SHA-3 functions implement hash.Hash. The
SHAKE functions implement a new "ShakeHash" interface that implements
io.Reader, io.Writer, and Reset().
(The previous Barrier() function has been removed.)
(Alternative proposal: Don't implement io.Reader, but instead provide a
"Digest(d []byte) error" function that performs a hash.Hash style copy.
Somewhat more minimal, but very easy to use incorrectly.)
2. Tests
Added the complete set of ShortMsgKATs from
https://github.com/gvanas/KeccakCodePackage
3. Correctness
In sync with draft FIPS-202.
4. Documentation
A summary of the security properties of the SHA-3 and SHAKE functions is
provided in doc.go; some concrete recommendations as well.
Fixes 8563.
R=golang-codereviews, agl
CC=golang-codereviews
https://golang.org/cl/130950043
2014-09-03 12:04:00 -07:00
Eric Roshan-Eisner
d52ec73510
go.crypto/sha3: change keccakF to stateless function
...
Taken from my implementation: https://bitbucket.org/ede/sha3
Performance gain from using less memory and more registers.
benchmark old ns/op new ns/op delta
BenchmarkPermutationFunction 1484 1118 -24.66%
BenchmarkBulkKeccak512 374993 295178 -21.28%
BenchmarkBulkKeccak256 215496 172335 -20.03%
benchmark old MB/s new MB/s speedup
BenchmarkPermutationFunction 134.76 178.80 1.33x
BenchmarkBulkKeccak512 43.69 55.51 1.27x
BenchmarkBulkKeccak256 76.03 95.07 1.25x
R=jcb, agl
CC=golang-dev, nigeltao
https://golang.org/cl/8088044
2013-04-02 10:41:35 -04:00
Joseph Bonneau
0bc0bccba9
go.crypto/sha3: new package
...
Added a pure Go implementation of SHA3 (Keccak) which implements the hash.Hash interface.
A test file is included with performance benchmarks and standard test vectors.
R=agl, nigeltao
CC=golang-dev
https://golang.org/cl/7760044
2013-03-22 14:59:59 -04:00
Filippo Valsorda
Matthew Dempsky
HowJmay
Bryan C. Mills
Michael Munday
Martin Hamrle
David Leon Gil
Eric Roshan-Eisner
Joseph Bonneau