From mboxrd@z Thu Jan 1 00:00:00 1970 From: Eric Biggers Subject: Re: [PATCH] poly1305: generic C can be faster on chips with slow unaligned access Date: Mon, 7 Nov 2016 11:25:05 -0800 Message-ID: <20161107192505.GB34388@google.com> References: <20161103004934.GA30775@gondor.apana.org.au> <20161103.130852.1456848512897088071.davem@davemloft.net> <20161104173723.GB34176@google.com> <20161107182646.GA34388@google.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Cc: Herbert Xu , Martin Willi , LKML , linux-crypto@vger.kernel.org, David Miller , WireGuard mailing list To: "Jason A. Donenfeld" Return-path: Content-Disposition: inline In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: wireguard-bounces@lists.zx2c4.com Sender: "WireGuard" List-Id: linux-crypto.vger.kernel.org On Mon, Nov 07, 2016 at 08:02:35PM +0100, Jason A. Donenfeld wrote: > On Mon, Nov 7, 2016 at 7:26 PM, Eric Biggers wrote: > > > > I was not referring to any users in particular, only what users could do. As an > > example, if you did crypto_shash_update() with 32, 15, then 17 bytes, and the > > underlying algorithm is poly1305-generic, the last block would end up > > misaligned. This doesn't appear possible with your pseudocode because it only > > passes in multiples of the block size until the very end. However I don't see > > it claimed anywhere that shash API users have to do that. > > Actually it appears that crypto/poly1305_generic.c already buffers > incoming blocks to a buffer that definitely looks aligned, to prevent > this condition! > No it does *not* buffer all incoming blocks, which is why the source pointer can fall out of alignment. Yes, I actually tested this. In fact this situation is even hit, in both possible places, in the self-tests. Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: ebiggers@google.com Received: from mail-pf0-f175.google.com (mail-pf0-f175.google.com [209.85.192.175]) by krantz.zx2c4.com (ZX2C4 Mail Server) with ESMTP id ee701e3f for ; Mon, 7 Nov 2016 19:23:23 +0000 (UTC) Received: by mail-pf0-f175.google.com with SMTP id d2so94999466pfd.0 for ; Mon, 07 Nov 2016 11:25:09 -0800 (PST) Return-Path: Date: Mon, 7 Nov 2016 11:25:05 -0800 From: Eric Biggers To: "Jason A. Donenfeld" Message-ID: <20161107192505.GB34388@google.com> References: <20161103004934.GA30775@gondor.apana.org.au> <20161103.130852.1456848512897088071.davem@davemloft.net> <20161104173723.GB34176@google.com> <20161107182646.GA34388@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii In-Reply-To: Cc: Herbert Xu , Martin Willi , LKML , linux-crypto@vger.kernel.org, David Miller , WireGuard mailing list Subject: Re: [WireGuard] [PATCH] poly1305: generic C can be faster on chips with slow unaligned access List-Id: Development discussion of WireGuard List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , On Mon, Nov 07, 2016 at 08:02:35PM +0100, Jason A. Donenfeld wrote: > On Mon, Nov 7, 2016 at 7:26 PM, Eric Biggers wrote: > > > > I was not referring to any users in particular, only what users could do. As an > > example, if you did crypto_shash_update() with 32, 15, then 17 bytes, and the > > underlying algorithm is poly1305-generic, the last block would end up > > misaligned. This doesn't appear possible with your pseudocode because it only > > passes in multiples of the block size until the very end. However I don't see > > it claimed anywhere that shash API users have to do that. > > Actually it appears that crypto/poly1305_generic.c already buffers > incoming blocks to a buffer that definitely looks aligned, to prevent > this condition! > No it does *not* buffer all incoming blocks, which is why the source pointer can fall out of alignment. Yes, I actually tested this. In fact this situation is even hit, in both possible places, in the self-tests. Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751367AbcKGTZM (ORCPT ); Mon, 7 Nov 2016 14:25:12 -0500 Received: from mail-pf0-f172.google.com ([209.85.192.172]:35920 "EHLO mail-pf0-f172.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750981AbcKGTZJ (ORCPT ); Mon, 7 Nov 2016 14:25:09 -0500 Date: Mon, 7 Nov 2016 11:25:05 -0800 From: Eric Biggers To: "Jason A. Donenfeld" Cc: David Miller , Herbert Xu , linux-crypto@vger.kernel.org, LKML , Martin Willi , WireGuard mailing list , =?iso-8859-1?Q?Ren=E9?= van Dorst Subject: Re: [PATCH] poly1305: generic C can be faster on chips with slow unaligned access Message-ID: <20161107192505.GB34388@google.com> References: <20161103004934.GA30775@gondor.apana.org.au> <20161103.130852.1456848512897088071.davem@davemloft.net> <20161104173723.GB34176@google.com> <20161107182646.GA34388@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Nov 07, 2016 at 08:02:35PM +0100, Jason A. Donenfeld wrote: > On Mon, Nov 7, 2016 at 7:26 PM, Eric Biggers wrote: > > > > I was not referring to any users in particular, only what users could do. As an > > example, if you did crypto_shash_update() with 32, 15, then 17 bytes, and the > > underlying algorithm is poly1305-generic, the last block would end up > > misaligned. This doesn't appear possible with your pseudocode because it only > > passes in multiples of the block size until the very end. However I don't see > > it claimed anywhere that shash API users have to do that. > > Actually it appears that crypto/poly1305_generic.c already buffers > incoming blocks to a buffer that definitely looks aligned, to prevent > this condition! > No it does *not* buffer all incoming blocks, which is why the source pointer can fall out of alignment. Yes, I actually tested this. In fact this situation is even hit, in both possible places, in the self-tests. Eric