From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 19A27C433F5 for ; Thu, 27 Jan 2022 05:19:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S235811AbiA0FTb (ORCPT ); Thu, 27 Jan 2022 00:19:31 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37706 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231364AbiA0FTa (ORCPT ); Thu, 27 Jan 2022 00:19:30 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8E4A7C06161C for ; Wed, 26 Jan 2022 21:19:30 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 19411615BD for ; Thu, 27 Jan 2022 05:19:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41C67C340E4; Thu, 27 Jan 2022 05:19:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1643260769; bh=vWfaLq/qC52SFr+J0SFQONIJabGEv3kLS5rXjzoTqk4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=pgXGaXr0i/TZHK9Vy0eERjKknMvG6VwAHr/WXP3oNCX3RpNwpaKWFcxUdI8ERFzWs 9DQtngLi74fJyIGndlQ/SRQCXY0VPfqbo+AS5OoXWsy3mAalCjrfPCVCUZkXOwuvlX j3V1AnQc8MpVdNhJ710K3Evx/7oADXihmKXs1Plb0zZF8xMFRPxyYa+BP23u9PGLs8 F+6Ev4NmSvaBqx6fjf+iCj3TtFmGsw+acfQkJx/UhNKq0tc3Rg2znVeCNEDelkAIAR B381fRajRZGb5fnykD94tkRU02uO9whHqJAaMuxF8A8S+FJYvzXxnjzWnL3wxPR8bq E3JQfFtnYqrFw== Date: Wed, 26 Jan 2022 21:19:27 -0800 From: Eric Biggers To: Nathan Huckleberry Cc: linux-crypto@vger.kernel.org, Herbert Xu , "David S. Miller" , linux-arm-kernel@lists.infradead.org, Paul Crowley , Sami Tolvanen Subject: Re: [RFC PATCH 2/7] crypto: polyval - Add POLYVAL support Message-ID: References: <20220125014422.80552-1-nhuck@google.com> <20220125014422.80552-3-nhuck@google.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20220125014422.80552-3-nhuck@google.com> Precedence: bulk List-ID: X-Mailing-List: linux-crypto@vger.kernel.org On Mon, Jan 24, 2022 at 07:44:17PM -0600, Nathan Huckleberry wrote: > Add support for POLYVAL, an ε-universal hash function similar to GHASH. I think you mean ε-∆U (i.e. ε-∆-universal), as appears elsewhere in this patchset? > POLYVAL is used as a component to implement HCTR2 mode. > > POLYVAL is implemented as an shash algorithm. The implementation is > modified from ghash-generic.c. > > More information on POLYVAL can be found in the HCTR2 paper: > https://eprint.iacr.org/2021/1441.pdf > > Signed-off-by: Nathan Huckleberry This commit message could use a brief mention of why POLYVAL is used instead of GHASH, and where POLYVAL is originally from. It is in the paper, but it's worth emphasizing. > diff --git a/crypto/polyval-generic.c b/crypto/polyval-generic.c > new file mode 100644 > index 000000000000..63e908697ea0 > --- /dev/null > +++ b/crypto/polyval-generic.c > @@ -0,0 +1,183 @@ > +// SPDX-License-Identifier: GPL-2.0-only > +/* > + * POLYVAL: hash function for HCTR2. > + * > + * Copyright (c) 2007 Nokia Siemens Networks - Mikko Herranen > + * Copyright (c) 2009 Intel Corp. > + * Author: Huang Ying > + * Copyright 2021 Google LLC > + */ > + > +/* > + * Code based on crypto/ghash-generic.c > + * > + * POLYVAL is a keyed hash function similar to GHASH. POLYVAL uses a > + * different modulus for finite field multiplication which makes hardware > + * accelerated implementations on little-endian machines faster. > + * > + * Like GHASH, POLYVAL is not a cryptographic hash function and should > + * not be used outside of crypto modes explicitly designed to use POLYVAL. > + * > + */ This comment could use some more explanation about the implementation. The code is using the implementation trick where the multiplication is actually done using the GHASH field, but it is not explained. Also, it should be explained why this implementation was chosen. The reason that the GHASH trick is used instead of doing a POLYVAL native implementation is because in practice, one of the accelerated implementations will/should be used instead, right? So this one didn't matter much -- there just had to be a generic implementation. There should also be a warning that this implementation isn't constant-time. - Eric From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from bombadil.infradead.org (bombadil.infradead.org [198.137.202.133]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id DFD05C433F5 for ; Thu, 27 Jan 2022 05:20:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=bombadil.20210309; h=Sender: Content-Transfer-Encoding:Content-Type:List-Subscribe:List-Help:List-Post: List-Archive:List-Unsubscribe:List-Id:In-Reply-To:MIME-Version:References: Message-ID:Subject:Cc:To:From:Date:Reply-To:Content-ID:Content-Description: Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID: List-Owner; bh=24lcr3l+pJKxSOm+lUt7T8vn9UPGBIDTxT3YtXO33mw=; b=D08ra3Ia4QXeeV ysK3v7vvUtDZ+xX0axiq8JO/J7La96Wx6Wmv0Qmt+07FPQF0UE7pEHZlsw0wyvmPvJF5SdzUoLMCN hsLOWOkAA8wNePR2WlpWanvCxpSwRJj7eFpNuTG1OiRyke9bnRsRLzY0/OlsJAIXw/g0rrxp7ep17 u5YYcocUcIsUjsACqVLGFgUFD/i7O8rWJUZ2IYjDqMWFReq3A4Z/QZJtSLbI1aEYxnXsn6Kz0OYpv YJuYNKjQNt/6xKKuUsjdTzWLYw8DWqSF/Mm/dW+zhr+6X04ML7G9Ncyk+6Zr2toh4o7KzTu7XWzth 4K1KW2+zBpWVuoquvK/A==; Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.94.2 #2 (Red Hat Linux)) id 1nCxC2-00ENzb-OU; Thu, 27 Jan 2022 05:19:34 +0000 Received: from dfw.source.kernel.org ([139.178.84.217]) by bombadil.infradead.org with esmtps (Exim 4.94.2 #2 (Red Hat Linux)) id 1nCxBy-00ENzF-Jr for linux-arm-kernel@lists.infradead.org; Thu, 27 Jan 2022 05:19:32 +0000 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 1A9F061846; Thu, 27 Jan 2022 05:19:30 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 41C67C340E4; Thu, 27 Jan 2022 05:19:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1643260769; bh=vWfaLq/qC52SFr+J0SFQONIJabGEv3kLS5rXjzoTqk4=; h=Date:From:To:Cc:Subject:References:In-Reply-To:From; b=pgXGaXr0i/TZHK9Vy0eERjKknMvG6VwAHr/WXP3oNCX3RpNwpaKWFcxUdI8ERFzWs 9DQtngLi74fJyIGndlQ/SRQCXY0VPfqbo+AS5OoXWsy3mAalCjrfPCVCUZkXOwuvlX j3V1AnQc8MpVdNhJ710K3Evx/7oADXihmKXs1Plb0zZF8xMFRPxyYa+BP23u9PGLs8 F+6Ev4NmSvaBqx6fjf+iCj3TtFmGsw+acfQkJx/UhNKq0tc3Rg2znVeCNEDelkAIAR B381fRajRZGb5fnykD94tkRU02uO9whHqJAaMuxF8A8S+FJYvzXxnjzWnL3wxPR8bq E3JQfFtnYqrFw== Date: Wed, 26 Jan 2022 21:19:27 -0800 From: Eric Biggers To: Nathan Huckleberry Cc: linux-crypto@vger.kernel.org, Herbert Xu , "David S. Miller" , linux-arm-kernel@lists.infradead.org, Paul Crowley , Sami Tolvanen Subject: Re: [RFC PATCH 2/7] crypto: polyval - Add POLYVAL support Message-ID: References: <20220125014422.80552-1-nhuck@google.com> <20220125014422.80552-3-nhuck@google.com> MIME-Version: 1.0 Content-Disposition: inline In-Reply-To: <20220125014422.80552-3-nhuck@google.com> X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20220126_211930_758317_93A98FE8 X-CRM114-Status: GOOD ( 25.04 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org T24gTW9uLCBKYW4gMjQsIDIwMjIgYXQgMDc6NDQ6MTdQTSAtMDYwMCwgTmF0aGFuIEh1Y2tsZWJl cnJ5IHdyb3RlOgo+IEFkZCBzdXBwb3J0IGZvciBQT0xZVkFMLCBhbiDOtS11bml2ZXJzYWwgaGFz aCBmdW5jdGlvbiBzaW1pbGFyIHRvIEdIQVNILgoKSSB0aGluayB5b3UgbWVhbiDOtS3iiIZVIChp LmUuIM61LeKIhi11bml2ZXJzYWwpLCBhcyBhcHBlYXJzIGVsc2V3aGVyZSBpbiB0aGlzCnBhdGNo c2V0PwoKPiBQT0xZVkFMIGlzIHVzZWQgYXMgYSBjb21wb25lbnQgdG8gaW1wbGVtZW50IEhDVFIy IG1vZGUuCj4gCj4gUE9MWVZBTCBpcyBpbXBsZW1lbnRlZCBhcyBhbiBzaGFzaCBhbGdvcml0aG0u ICBUaGUgaW1wbGVtZW50YXRpb24gaXMKPiBtb2RpZmllZCBmcm9tIGdoYXNoLWdlbmVyaWMuYy4K PiAKPiBNb3JlIGluZm9ybWF0aW9uIG9uIFBPTFlWQUwgY2FuIGJlIGZvdW5kIGluIHRoZSBIQ1RS MiBwYXBlcjoKPiBodHRwczovL2VwcmludC5pYWNyLm9yZy8yMDIxLzE0NDEucGRmCj4gCj4gU2ln bmVkLW9mZi1ieTogTmF0aGFuIEh1Y2tsZWJlcnJ5IDxuaHVja0Bnb29nbGUuY29tPgoKVGhpcyBj b21taXQgbWVzc2FnZSBjb3VsZCB1c2UgYSBicmllZiBtZW50aW9uIG9mIHdoeSBQT0xZVkFMIGlz IHVzZWQgaW5zdGVhZCBvZgpHSEFTSCwgYW5kIHdoZXJlIFBPTFlWQUwgaXMgb3JpZ2luYWxseSBm cm9tLiAgSXQgaXMgaW4gdGhlIHBhcGVyLCBidXQgaXQncyB3b3J0aAplbXBoYXNpemluZy4KCj4g ZGlmZiAtLWdpdCBhL2NyeXB0by9wb2x5dmFsLWdlbmVyaWMuYyBiL2NyeXB0by9wb2x5dmFsLWdl bmVyaWMuYwo+IG5ldyBmaWxlIG1vZGUgMTAwNjQ0Cj4gaW5kZXggMDAwMDAwMDAwMDAwLi42M2U5 MDg2OTdlYTAKPiAtLS0gL2Rldi9udWxsCj4gKysrIGIvY3J5cHRvL3BvbHl2YWwtZ2VuZXJpYy5j Cj4gQEAgLTAsMCArMSwxODMgQEAKPiArLy8gU1BEWC1MaWNlbnNlLUlkZW50aWZpZXI6IEdQTC0y LjAtb25seQo+ICsvKgo+ICsgKiBQT0xZVkFMOiBoYXNoIGZ1bmN0aW9uIGZvciBIQ1RSMi4KPiAr ICoKPiArICogQ29weXJpZ2h0IChjKSAyMDA3IE5va2lhIFNpZW1lbnMgTmV0d29ya3MgLSBNaWtr byBIZXJyYW5lbiA8bWgxQGlraS5maT4KPiArICogQ29weXJpZ2h0IChjKSAyMDA5IEludGVsIENv cnAuCj4gKyAqICAgQXV0aG9yOiBIdWFuZyBZaW5nIDx5aW5nLmh1YW5nQGludGVsLmNvbT4KPiAr ICogQ29weXJpZ2h0IDIwMjEgR29vZ2xlIExMQwo+ICsgKi8KPiArCj4gKy8qCj4gKyAqIENvZGUg YmFzZWQgb24gY3J5cHRvL2doYXNoLWdlbmVyaWMuYwo+ICsgKgo+ICsgKiBQT0xZVkFMIGlzIGEg a2V5ZWQgaGFzaCBmdW5jdGlvbiBzaW1pbGFyIHRvIEdIQVNILiBQT0xZVkFMIHVzZXMgYQo+ICsg KiBkaWZmZXJlbnQgbW9kdWx1cyBmb3IgZmluaXRlIGZpZWxkIG11bHRpcGxpY2F0aW9uIHdoaWNo IG1ha2VzIGhhcmR3YXJlCj4gKyAqIGFjY2VsZXJhdGVkIGltcGxlbWVudGF0aW9ucyBvbiBsaXR0 bGUtZW5kaWFuIG1hY2hpbmVzIGZhc3Rlci4KPiArICoKPiArICogTGlrZSBHSEFTSCwgUE9MWVZB TCBpcyBub3QgYSBjcnlwdG9ncmFwaGljIGhhc2ggZnVuY3Rpb24gYW5kIHNob3VsZAo+ICsgKiBu b3QgYmUgdXNlZCBvdXRzaWRlIG9mIGNyeXB0byBtb2RlcyBleHBsaWNpdGx5IGRlc2lnbmVkIHRv IHVzZSBQT0xZVkFMLgo+ICsgKgo+ICsgKi8KClRoaXMgY29tbWVudCBjb3VsZCB1c2Ugc29tZSBt b3JlIGV4cGxhbmF0aW9uIGFib3V0IHRoZSBpbXBsZW1lbnRhdGlvbi4gIFRoZSBjb2RlCmlzIHVz aW5nIHRoZSBpbXBsZW1lbnRhdGlvbiB0cmljayB3aGVyZSB0aGUgbXVsdGlwbGljYXRpb24gaXMg YWN0dWFsbHkgZG9uZQp1c2luZyB0aGUgR0hBU0ggZmllbGQsIGJ1dCBpdCBpcyBub3QgZXhwbGFp bmVkLiAgQWxzbywgaXQgc2hvdWxkIGJlIGV4cGxhaW5lZAp3aHkgdGhpcyBpbXBsZW1lbnRhdGlv biB3YXMgY2hvc2VuLiAgVGhlIHJlYXNvbiB0aGF0IHRoZSBHSEFTSCB0cmljayBpcyB1c2VkCmlu c3RlYWQgb2YgZG9pbmcgYSBQT0xZVkFMIG5hdGl2ZSBpbXBsZW1lbnRhdGlvbiBpcyBiZWNhdXNl IGluIHByYWN0aWNlLCBvbmUgb2YKdGhlIGFjY2VsZXJhdGVkIGltcGxlbWVudGF0aW9ucyB3aWxs L3Nob3VsZCBiZSB1c2VkIGluc3RlYWQsIHJpZ2h0PyAgU28gdGhpcyBvbmUKZGlkbid0IG1hdHRl ciBtdWNoIC0tIHRoZXJlIGp1c3QgaGFkIHRvIGJlIGEgZ2VuZXJpYyBpbXBsZW1lbnRhdGlvbi4K ClRoZXJlIHNob3VsZCBhbHNvIGJlIGEgd2FybmluZyB0aGF0IHRoaXMgaW1wbGVtZW50YXRpb24g aXNuJ3QgY29uc3RhbnQtdGltZS4KCi0gRXJpYyAKCl9fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fCmxpbnV4LWFybS1rZXJuZWwgbWFpbGluZyBsaXN0CmxpbnV4 LWFybS1rZXJuZWxAbGlzdHMuaW5mcmFkZWFkLm9yZwpodHRwOi8vbGlzdHMuaW5mcmFkZWFkLm9y Zy9tYWlsbWFuL2xpc3RpbmZvL2xpbnV4LWFybS1rZXJuZWwK