nettle-bugs

nettle-bugs@lists.lysator.liu.se

1 participants
2197 discussions

Trimming sha3 context struct
by Niels Möller 03 May '25

03 May '25

Hi, I recently realized that unlike other hash functions in Nettle, we can do without the block size buffer for sha3. Below patch reduces the buffer to just 8 bytes, since input can be xored directly to the state array (with the extra 8-byte buffer used for partial words on big endian platforms), and similarly, shake output can ge generated from the state array. The implementation of _update and _shake_output becomes a bit more complex, with separate code for big and little endian platforms. I had expected a minor speedup for little-endian, but I haven't seen any significant performance changes on my x86_64 machine. Before, the size of the context structs ranged from 280 bytes for sha3_512 to 352 bytes for sha3_224 and 376 for shake128. After these changes, all variants use the same context struct of 216 bytes. One can then eliminate the different struct sha3_*_ctx, replacing with a single struct sha3_ctx, and similarly only a single sha3_init function. Would it be useful to keep old names as preprocessor aliases? Either by default, or via a separate header nettle/sha3-compat.h? Regards, /Niels --------------8<--------- diff --git a/ed448-shake256-pubkey.c b/ed448-shake256-pubkey.c index bde18278..ce031aac 100644 --- a/ed448-shake256-pubkey.c +++ b/ed448-shake256-pubkey.c @@ -44,14 +44,14 @@ void ed448_shake256_public_key (uint8_t *pub, const uint8_t *priv) { const struct ecc_curve *ecc = &_nettle_curve448; - struct sha3_256_ctx ctx; + struct sha3_ctx ctx; uint8_t digest[ED448_SIGNATURE_SIZE]; mp_size_t itch = ecc->q.size + _eddsa_public_key_itch (ecc); mp_limb_t *scratch = gmp_alloc_limbs (itch); #define k scratch #define scratch_out (scratch + ecc->q.size) - sha3_256_init (&ctx); + sha3_init (&ctx); _eddsa_expand_key (ecc, &_nettle_ed448_shake256, &ctx, priv, digest, k); _eddsa_public_key (ecc, k, pub, scratch_out); diff --git a/ed448-shake256-sign.c b/ed448-shake256-sign.c index c524593d..5d3cdbd5 100644 --- a/ed448-shake256-sign.c +++ b/ed448-shake256-sign.c @@ -52,10 +52,10 @@ ed448_shake256_sign (const uint8_t *pub, mp_limb_t *scratch = gmp_alloc_limbs (itch); #define k2 scratch #define scratch_out (scratch + ecc->q.size) - struct sha3_256_ctx ctx; + struct sha3_ctx ctx; uint8_t digest[ED448_SIGNATURE_SIZE]; - sha3_256_init (&ctx); + sha3_init (&ctx); _eddsa_expand_key (ecc, eddsa, &ctx, priv, digest, k2); _eddsa_sign (ecc, eddsa, &ctx, diff --git a/ed448-shake256-verify.c b/ed448-shake256-verify.c index af16f107..0134faae 100644 --- a/ed448-shake256-verify.c +++ b/ed448-shake256-verify.c @@ -50,11 +50,11 @@ ed448_shake256_verify (const uint8_t *pub, const struct ecc_curve *ecc = &_nettle_curve448; mp_size_t itch = 3*ecc->p.size + _eddsa_verify_itch (ecc); mp_limb_t *scratch = gmp_alloc_limbs (itch); - struct sha3_256_ctx ctx; + struct sha3_ctx ctx; int res; #define A scratch #define scratch_out (scratch + 3*ecc->p.size) - sha3_256_init (&ctx); + sha3_init (&ctx); res = (_eddsa_decompress (ecc, A, pub, scratch_out) diff --git a/ed448-shake256.c b/ed448-shake256.c index 4522a158..b00150d4 100644 --- a/ed448-shake256.c +++ b/ed448-shake256.c @@ -52,7 +52,7 @@ ed448_dom(void *ctx) } static void -ed448_digest(struct sha3_256_ctx *ctx, uint8_t *digest) +ed448_digest(struct sha3_ctx *ctx, uint8_t *digest) { sha3_256_shake(ctx, 2*ED448_KEY_SIZE, digest); } diff --git a/nettle-internal.h b/nettle-internal.h index 81d06e80..1aed1007 100644 --- a/nettle-internal.h +++ b/nettle-internal.h @@ -39,7 +39,7 @@ #include <stdlib.h> /* For definition of NETTLE_MAX_HASH_CONTEXT_SIZE. */ -#include "sha3.h" +#include "streebog.h" /* Temporary allocation, for systems that don't support alloca. Note * that the allocation requests should always be reasonably small, so @@ -74,7 +74,7 @@ /* Limits that apply to systems that don't have alloca */ #define NETTLE_MAX_HASH_BLOCK_SIZE 144 /* For sha3_224*/ #define NETTLE_MAX_HASH_DIGEST_SIZE 64 -#define NETTLE_MAX_HASH_CONTEXT_SIZE (sizeof(struct sha3_224_ctx)) +#define NETTLE_MAX_HASH_CONTEXT_SIZE (sizeof(struct streebog512_ctx)) #define NETTLE_MAX_SEXP_ASSOC 17 #define NETTLE_MAX_CIPHER_BLOCK_SIZE 32 #define NETTLE_MAX_CIPHER_KEY_SIZE 32 diff --git a/sha3-224-meta.c b/sha3-224-meta.c index bf39bc3b..6c5a76cd 100644 --- a/sha3-224-meta.c +++ b/sha3-224-meta.c @@ -39,4 +39,4 @@ #include "sha3-internal.h" const struct nettle_hash nettle_sha3_224 -= _NETTLE_HASH(sha3_224, SHA3_224); += _NETTLE_SHA3_HASH(sha3_224, SHA3_224); diff --git a/sha3-224.c b/sha3-224.c index 08afce69..0b20d19b 100644 --- a/sha3-224.c +++ b/sha3-224.c @@ -35,32 +35,17 @@ # include "config.h" #endif -#include <stddef.h> -#include <string.h> - #include "sha3.h" #include "sha3-internal.h" -#include "nettle-write.h" - -void -sha3_224_init (struct sha3_224_ctx *ctx) -{ - memset (ctx, 0, offsetof (struct sha3_224_ctx, block)); -} - void -sha3_224_update (struct sha3_224_ctx *ctx, size_t length, const uint8_t *data) +sha3_224_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data) { - ctx->index = _nettle_sha3_update (&ctx->state, - SHA3_224_BLOCK_SIZE, ctx->block, - ctx->index, length, data); + _nettle_sha3_update (ctx, SHA3_224_BLOCK_SIZE >> 3, length, data); } void -sha3_224_digest(struct sha3_224_ctx *ctx, uint8_t *digest) +sha3_224_digest(struct sha3_ctx *ctx, uint8_t *digest) { - _sha3_pad_hash (&ctx->state, SHA3_224_BLOCK_SIZE, ctx->block, ctx->index); - _nettle_write_le64 (SHA3_224_DIGEST_SIZE, digest, ctx->state.a); - sha3_224_init (ctx); + _nettle_sha3_digest (ctx, SHA3_224_BLOCK_SIZE >> 3, SHA3_224_DIGEST_SIZE, digest); } diff --git a/sha3-256-meta.c b/sha3-256-meta.c index 649d7422..40e841e7 100644 --- a/sha3-256-meta.c +++ b/sha3-256-meta.c @@ -39,4 +39,4 @@ #include "sha3-internal.h" const struct nettle_hash nettle_sha3_256 -= _NETTLE_HASH(sha3_256, SHA3_256); += _NETTLE_SHA3_HASH(sha3_256, SHA3_256); diff --git a/sha3-256.c b/sha3-256.c index c347e13b..557c69f3 100644 --- a/sha3-256.c +++ b/sha3-256.c @@ -35,32 +35,17 @@ # include "config.h" #endif -#include <stddef.h> -#include <string.h> - #include "sha3.h" #include "sha3-internal.h" -#include "nettle-write.h" - -void -sha3_256_init (struct sha3_256_ctx *ctx) -{ - memset (ctx, 0, offsetof (struct sha3_256_ctx, block)); -} - void -sha3_256_update (struct sha3_256_ctx *ctx, size_t length, const uint8_t *data) +sha3_256_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data) { - ctx->index = _nettle_sha3_update (&ctx->state, - SHA3_256_BLOCK_SIZE, ctx->block, - ctx->index, length, data); + _nettle_sha3_update (ctx, SHA3_256_BLOCK_SIZE >> 3, length, data); } void -sha3_256_digest(struct sha3_256_ctx *ctx, uint8_t *digest) +sha3_256_digest(struct sha3_ctx *ctx, uint8_t *digest) { - _sha3_pad_hash (&ctx->state, SHA3_256_BLOCK_SIZE, ctx->block, ctx->index); - _nettle_write_le64 (SHA3_256_DIGEST_SIZE, digest, ctx->state.a); - sha3_256_init (ctx); + _nettle_sha3_digest (ctx, SHA3_256_BLOCK_SIZE >> 3, SHA3_256_DIGEST_SIZE, digest); } diff --git a/sha3-384-meta.c b/sha3-384-meta.c index 38373394..2c03d711 100644 --- a/sha3-384-meta.c +++ b/sha3-384-meta.c @@ -39,4 +39,4 @@ #include "sha3-internal.h" const struct nettle_hash nettle_sha3_384 -= _NETTLE_HASH(sha3_384, SHA3_384); += _NETTLE_SHA3_HASH(sha3_384, SHA3_384); diff --git a/sha3-384.c b/sha3-384.c index ea8dd038..13a4ef29 100644 --- a/sha3-384.c +++ b/sha3-384.c @@ -35,32 +35,17 @@ # include "config.h" #endif -#include <stddef.h> -#include <string.h> - #include "sha3.h" #include "sha3-internal.h" -#include "nettle-write.h" - -void -sha3_384_init (struct sha3_384_ctx *ctx) -{ - memset (ctx, 0, offsetof (struct sha3_384_ctx, block)); -} - void -sha3_384_update (struct sha3_384_ctx *ctx, size_t length, const uint8_t *data) +sha3_384_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data) { - ctx->index = _nettle_sha3_update (&ctx->state, - SHA3_384_BLOCK_SIZE, ctx->block, - ctx->index, length, data); + _nettle_sha3_update (ctx, SHA3_384_BLOCK_SIZE >> 3, length, data); } void -sha3_384_digest(struct sha3_384_ctx *ctx, uint8_t *digest) +sha3_384_digest(struct sha3_ctx *ctx, uint8_t *digest) { - _sha3_pad_hash (&ctx->state, SHA3_384_BLOCK_SIZE, ctx->block, ctx->index); - _nettle_write_le64 (SHA3_384_DIGEST_SIZE, digest, ctx->state.a); - sha3_384_init (ctx); + _nettle_sha3_digest (ctx, SHA3_384_BLOCK_SIZE >> 3, SHA3_384_DIGEST_SIZE, digest); } diff --git a/sha3-512-meta.c b/sha3-512-meta.c index aff96373..61c22220 100644 --- a/sha3-512-meta.c +++ b/sha3-512-meta.c @@ -39,4 +39,4 @@ #include "sha3-internal.h" const struct nettle_hash nettle_sha3_512 -= _NETTLE_HASH(sha3_512, SHA3_512); += _NETTLE_SHA3_HASH(sha3_512, SHA3_512); diff --git a/sha3-512.c b/sha3-512.c index 9ae014dc..632c50c0 100644 --- a/sha3-512.c +++ b/sha3-512.c @@ -35,32 +35,17 @@ # include "config.h" #endif -#include <stddef.h> -#include <string.h> - #include "sha3.h" #include "sha3-internal.h" -#include "nettle-write.h" - -void -sha3_512_init (struct sha3_512_ctx *ctx) -{ - memset (ctx, 0, offsetof (struct sha3_512_ctx, block)); -} - void -sha3_512_update (struct sha3_512_ctx *ctx, size_t length, const uint8_t *data) +sha3_512_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data) { - ctx->index = _nettle_sha3_update (&ctx->state, - SHA3_512_BLOCK_SIZE, ctx->block, - ctx->index, length, data); + _nettle_sha3_update (ctx, SHA3_512_BLOCK_SIZE >> 3, length, data); } void -sha3_512_digest(struct sha3_512_ctx *ctx, uint8_t *digest) +sha3_512_digest(struct sha3_ctx *ctx, uint8_t *digest) { - _sha3_pad_hash (&ctx->state, SHA3_512_BLOCK_SIZE, ctx->block, ctx->index); - _nettle_write_le64 (SHA3_512_DIGEST_SIZE, digest, ctx->state.a); - sha3_512_init (ctx); + _nettle_sha3_digest (ctx, SHA3_512_BLOCK_SIZE >> 3, SHA3_512_DIGEST_SIZE, digest); } diff --git a/sha3-internal.h b/sha3-internal.h index 669b9449..8a09db45 100644 --- a/sha3-internal.h +++ b/sha3-internal.h @@ -39,35 +39,37 @@ #define SHA3_HASH_MAGIC 6 #define SHA3_SHAKE_MAGIC 0x1f -unsigned -_nettle_sha3_update (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned pos, - size_t length, const uint8_t *data); - +void +_nettle_sha3_init (struct sha3_ctx *ctx); +/* For all functions, the block_size is in units of uint64_t words. */ void -_nettle_sha3_pad (struct sha3_state *state, - unsigned block_size, uint8_t *block, unsigned pos, uint8_t magic); +_nettle_sha3_update (struct sha3_ctx *ctx, unsigned block_size, + size_t length, const uint8_t *data); -#define _sha3_pad_hash(state, block_size, block, pos) do { \ - _nettle_sha3_pad (state, block_size, block, pos, SHA3_HASH_MAGIC); \ - sha3_permute (state); \ - } while (0) +void +_nettle_sha3_pad (struct sha3_ctx *ctx, unsigned block_size, uint8_t magic); -#define _sha3_pad_shake(state, block_size, block, pos) \ - _nettle_sha3_pad (state, block_size, block, pos, SHA3_SHAKE_MAGIC) +void +_nettle_sha3_digest (struct sha3_ctx *ctx, unsigned block_size, + unsigned digest_size, uint8_t *digest); void -_nettle_sha3_shake (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned index, +_nettle_sha3_shake (struct sha3_ctx *ctx, unsigned block_size, size_t length, uint8_t *dst); -unsigned -_nettle_sha3_shake_output (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned index, +void +_nettle_sha3_shake_output (struct sha3_ctx *ctx, unsigned block_size, size_t length, uint8_t *dst); +#define _NETTLE_SHA3_HASH(name, NAME) { \ + #name, \ + sizeof(struct sha3_ctx), \ + NAME##_DIGEST_SIZE, \ + NAME##_BLOCK_SIZE, \ + (nettle_hash_init_func *) sha3_init, \ + (nettle_hash_update_func *) name##_update, \ + (nettle_hash_digest_func *) name##_digest \ +} + #endif diff --git a/sha3-shake.c b/sha3-shake.c index d9312bbb..3e0ab634 100644 --- a/sha3-shake.c +++ b/sha3-shake.c @@ -41,76 +41,109 @@ #include "sha3.h" #include "sha3-internal.h" +#include "bswap-internal.h" +#include "macros.h" #include "nettle-write.h" void -_nettle_sha3_shake (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned index, +_nettle_sha3_shake (struct sha3_ctx *ctx, unsigned block_size, size_t length, uint8_t *dst) { - _sha3_pad_shake (state, block_size, block, index); + _nettle_sha3_pad (ctx, block_size, SHA3_SHAKE_MAGIC); + + /* Use byte units. */ + block_size <<= 3; while (length > block_size) { - sha3_permute (state); - _nettle_write_le64 (block_size, dst, state->a); - length -= block_size; - dst += block_size; + sha3_permute (&ctx->state); + _nettle_write_le64 (block_size, dst, ctx->state.a); + length -= block_size; dst += block_size; } - sha3_permute (state); - _nettle_write_le64 (length, dst, state->a); + sha3_permute (&ctx->state); + _nettle_write_le64 (length, dst, ctx->state.a); + sha3_init (ctx); } -unsigned -_nettle_sha3_shake_output (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned index, +void +_nettle_sha3_shake_output (struct sha3_ctx *ctx, unsigned block_size, size_t length, uint8_t *dst) { - unsigned left; + unsigned index = ctx->index; + unsigned block_bytes = block_size << 3; - /* We use one's complement of the index value to indicate SHAKE is - initialized. */ - if (index < block_size) + if (!ctx->shake_flag) { /* This is the first call of _shake_output. */ - _sha3_pad_shake (state, block_size, block, index); + _nettle_sha3_pad (ctx, block_size, SHA3_SHAKE_MAGIC); /* Point at the end of block to trigger fill in of the buffer. */ - index = block_size; + index = block_bytes; + ctx->shake_flag = 1; } - else - index = ~index; - assert (index <= block_size); + assert (index <= block_bytes); + { +#if WORDS_BIGENDIAN + unsigned byte_index = index & 7; - /* Write remaining data from the buffer. */ - left = block_size - index; + if (byte_index) + { + unsigned left = 8 - byte_index; if (length <= left) { - memcpy (dst, block + index, length); - return ~(index + length); + memcpy (dst, ctx->block.b + byte_index, length); + ctx->index = index + length; + return; + } + memcpy (dst, ctx->block.b + byte_index, left); + dst += left; length -= left; index += left; + } + + /* Switch to units of words */ + index >>= 3; + + for (; length > 0; length -= 8, dst += 8, index++) + { + if (index == block_size) + { + sha3_permute (&ctx->state); + index = 0; + } + if (length < 8) + { + ctx->block.u64 = nettle_bswap64 (ctx->state.a[index]); + memcpy (dst, ctx->block.b, length); + break; + } + LE_WRITE_UINT64(dst, ctx->state.a[index]); + } + ctx->index = (index << 3) + length; +#else /* !WORDS_BIGENDIAN */ + size_t left = block_bytes - index; + if (length <= left) + { + memcpy (dst, ((const uint8_t *) ctx->state.a) + index, length); + ctx->index = index + length; + return; } else { - memcpy (dst, block + index, left); + memcpy (dst, ((const uint8_t *) ctx->state.a) + index, left); length -= left; dst += left; } /* Write full blocks. */ - while (length > block_size) + for (; length > block_bytes; length -= block_bytes, dst += block_bytes) { - sha3_permute (state); - _nettle_write_le64 (block_size, dst, state->a); - length -= block_size; - dst += block_size; + sha3_permute (&ctx->state); + _nettle_write_le64 (block_bytes, dst, ctx->state.a); } - sha3_permute (state); - /* Fill in the buffer for next call. */ - _nettle_write_le64 (block_size, block, state->a); - memcpy (dst, block, length); - return ~length; + sha3_permute (&ctx->state); + memcpy (dst, ctx->state.a, length); + ctx->index = length; +#endif /* !WORDS_BIGENDIAN */ + } } diff --git a/sha3.c b/sha3.c index d2f27323..f378b9c6 100644 --- a/sha3.c +++ b/sha3.c @@ -35,70 +35,110 @@ # include "config.h" #endif -#include <assert.h> #include <string.h> #include "sha3.h" #include "sha3-internal.h" +#include "bswap-internal.h" #include "macros.h" -#include "md-internal.h" #include "memxor.h" +#include "nettle-write.h" -#if WORDS_BIGENDIAN -static void -sha3_xor_block (struct sha3_state *state, unsigned length, const uint8_t *data) -{ - assert ( (length & 7) == 0); - { - uint64_t *p; - for (p = state->a; length > 0; p++, length -= 8, data += 8) - *p ^= LE_READ_UINT64 (data); - } -} -#else /* !WORDS_BIGENDIAN */ -#define sha3_xor_block(state, length, data) memxor (state->a, data, length) -#endif - -static void -sha3_absorb (struct sha3_state *state, unsigned length, const uint8_t *data) +void +sha3_init (struct sha3_ctx *ctx) { - sha3_xor_block (state, length, data); - sha3_permute (state); + memset (ctx, 0, offsetof (struct sha3_ctx, block)); } -unsigned -_nettle_sha3_update (struct sha3_state *state, - unsigned block_size, uint8_t *block, - unsigned pos, +void +_nettle_sha3_update (struct sha3_ctx *ctx, unsigned block_size, size_t length, const uint8_t *data) { - assert (pos < block_size); +#if WORDS_BIGENDIAN + unsigned byte_index = ctx->index & 7; + unsigned index = ctx->index >> 3; - if (!length) - return pos; + if (byte_index > 0) + { + unsigned left = sizeof (ctx->block) - byte_index; + if (length < left) + { + memcpy (ctx->block.b + byte_index, data, length); + ctx->index += length; + return; + } + memcpy (ctx->block.b + byte_index, data, left); + data += left; length -= left; - if (pos > 0) + ctx->state.a[index++] ^= nettle_bswap64 (ctx->block.u64); + if (index == block_size) { - MD_FILL_OR_RETURN_INDEX (block_size, block, pos, length, data); - sha3_absorb (state, block_size, block); + sha3_permute (&ctx->state); + index = 0; + } } - for (; length >= block_size; length -= block_size, data += block_size) - sha3_absorb (state, block_size, data); - memcpy (block, data, length); - return length; + for (; length >= 8; length -= 8, data += 8) + { + ctx->state.a[index++] ^= LE_READ_UINT64 (data); + if (index == block_size) + { + sha3_permute (&ctx->state); + index = 0; + } + } + memcpy (ctx->block.b, data, length); + ctx->index = (index << 3) + length; +#else /* !WORDS_BIGENDIAN */ + /* Switch to units of bytes. */ + block_size <<= 3; + if (ctx->index > 0) + { + unsigned left = block_size - ctx->index; + if (length < left) + { + memxor ((uint8_t *) ctx->state.a + ctx->index, data, length); + ctx->index += length; + return; + } + memxor ((uint8_t *) ctx->state.a + ctx->index, data, left); + data += left; length -= left; + ctx->index = 0; + sha3_permute (&ctx->state); + } + for (; length >= block_size; length -= block_size, data += block_size) + { + memxor ((uint8_t *) ctx->state.a, data, block_size); + sha3_permute (&ctx->state); + } + memxor ((uint8_t *) ctx->state.a, data, length); + ctx->index = length; +#endif /* !WORDS_BIGENDIAN */ } void -_nettle_sha3_pad (struct sha3_state *state, - unsigned block_size, uint8_t *block, unsigned pos, uint8_t magic) +_nettle_sha3_pad (struct sha3_ctx *ctx, unsigned block_size, uint8_t magic) { - assert (pos < block_size); - block[pos++] = magic; +#if WORDS_BIGENDIAN + unsigned byte_index = ctx->index & 7; + unsigned word_index = ctx->index >> 3; - memset (block + pos, 0, block_size - pos); - block[block_size - 1] |= 0x80; + ctx->block.b[byte_index++] = magic; + memset (ctx->block.b + byte_index, 0, 8 - byte_index); + ctx->state.a[word_index] ^= nettle_bswap64 (ctx->block.u64); +#else /* !WORDS_BIGENDIAN */ + ((uint8_t *) ctx->state.a)[ctx->index] ^= magic; +#endif /* !WORDS_BIGENDIAN */ + ctx->state.a[block_size - 1] ^= (uint64_t) 1 << 63; +} - sha3_xor_block (state, block_size, block); +void +_nettle_sha3_digest (struct sha3_ctx *ctx, unsigned block_size, + unsigned digest_size, uint8_t *digest) +{ + _nettle_sha3_pad (ctx, block_size, SHA3_HASH_MAGIC); + sha3_permute (&ctx->state); + _nettle_write_le64 (digest_size, digest, ctx->state.a); + sha3_init (ctx); } diff --git a/sha3.h b/sha3.h index c499f395..7e4a7963 100644 --- a/sha3.h +++ b/sha3.h @@ -42,22 +42,18 @@ extern "C" { /* Name mangling */ #define sha3_permute nettle_sha3_permute -#define sha3_128_init nettle_sha3_128_init +#define sha3_init nettle_sha3_init #define sha3_128_update nettle_sha3_128_update #define sha3_128_shake nettle_sha3_128_shake #define sha3_128_shake_output nettle_sha3_128_shake_output -#define sha3_224_init nettle_sha3_224_init #define sha3_224_update nettle_sha3_224_update #define sha3_224_digest nettle_sha3_224_digest -#define sha3_256_init nettle_sha3_256_init #define sha3_256_update nettle_sha3_256_update #define sha3_256_digest nettle_sha3_256_digest #define sha3_256_shake nettle_sha3_256_shake #define sha3_256_shake_output nettle_sha3_256_shake_output -#define sha3_384_init nettle_sha3_384_init #define sha3_384_update nettle_sha3_384_update #define sha3_384_digest nettle_sha3_384_digest -#define sha3_512_init nettle_sha3_512_init #define sha3_512_update nettle_sha3_512_update #define sha3_512_digest nettle_sha3_512_digest @@ -98,98 +94,64 @@ sha3_permute (struct sha3_state *state); #define SHA3_512_DIGEST_SIZE 64 #define SHA3_512_BLOCK_SIZE 72 -struct sha3_128_ctx +struct sha3_ctx { struct sha3_state state; + /* The position in current block of next input byte (for update) or + next output byte (for shake). */ unsigned index; - uint8_t block[SHA3_128_BLOCK_SIZE]; + /* Set when shake output has been initialized. */ + int shake_flag; + /* Buffer for partial words; input and output from the state is + handled one uint64_t at a time. */ + union nettle_block8 block; }; void -sha3_128_init (struct sha3_128_ctx *ctx); +sha3_init (struct sha3_ctx *ctx); void -sha3_128_update (struct sha3_128_ctx *ctx, size_t length, const uint8_t *data); +sha3_128_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data); void -sha3_128_shake (struct sha3_128_ctx *ctx, size_t length, uint8_t *digest); +sha3_128_shake (struct sha3_ctx *ctx, size_t length, uint8_t *digest); void -sha3_128_shake_output (struct sha3_128_ctx *ctx, size_t length, uint8_t *digest); - -struct sha3_224_ctx -{ - struct sha3_state state; - unsigned index; - uint8_t block[SHA3_224_BLOCK_SIZE]; -}; - -void -sha3_224_init (struct sha3_224_ctx *ctx); +sha3_128_shake_output (struct sha3_ctx *ctx, size_t length, uint8_t *digest); void -sha3_224_update (struct sha3_224_ctx *ctx, size_t length, const uint8_t *data); - -void -sha3_224_digest(struct sha3_224_ctx *ctx, uint8_t *digest); - -struct sha3_256_ctx -{ - struct sha3_state state; - unsigned index; - uint8_t block[SHA3_256_BLOCK_SIZE]; -}; +sha3_224_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data); void -sha3_256_init (struct sha3_256_ctx *ctx); +sha3_224_digest(struct sha3_ctx *ctx, uint8_t *digest); void -sha3_256_update (struct sha3_256_ctx *ctx, size_t length, const uint8_t *data); +sha3_256_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data); void -sha3_256_digest(struct sha3_256_ctx *ctx, uint8_t *digest); +sha3_256_digest(struct sha3_ctx *ctx, uint8_t *digest); /* Alternative digest function implementing shake256, with arbitrary digest size */ void -sha3_256_shake(struct sha3_256_ctx *ctx, size_t length, uint8_t *digest); +sha3_256_shake(struct sha3_ctx *ctx, size_t length, uint8_t *digest); /* Unlike sha3_256_shake, this function can be called multiple times to retrieve output from shake256 in an incremental manner */ void -sha3_256_shake_output(struct sha3_256_ctx *ctx, size_t length, uint8_t *digest); - -struct sha3_384_ctx -{ - struct sha3_state state; - unsigned index; - uint8_t block[SHA3_384_BLOCK_SIZE]; -}; - -void -sha3_384_init (struct sha3_384_ctx *ctx); +sha3_256_shake_output(struct sha3_ctx *ctx, size_t length, uint8_t *digest); void -sha3_384_update (struct sha3_384_ctx *ctx, size_t length, const uint8_t *data); - -void -sha3_384_digest(struct sha3_384_ctx *ctx, uint8_t *digest); - -struct sha3_512_ctx -{ - struct sha3_state state; - unsigned index; - uint8_t block[SHA3_512_BLOCK_SIZE]; -}; +sha3_384_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data); void -sha3_512_init (struct sha3_512_ctx *ctx); +sha3_384_digest(struct sha3_ctx *ctx, uint8_t *digest); void -sha3_512_update (struct sha3_512_ctx *ctx, size_t length, const uint8_t *data); +sha3_512_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data); void -sha3_512_digest(struct sha3_512_ctx *ctx, uint8_t *digest); +sha3_512_digest(struct sha3_ctx *ctx, uint8_t *digest); #ifdef __cplusplus } diff --git a/shake128.c b/shake128.c index f0c68e7d..5f8b9610 100644 --- a/shake128.c +++ b/shake128.c @@ -36,37 +36,23 @@ # include "config.h" #endif -#include <string.h> - #include "sha3.h" #include "sha3-internal.h" void -sha3_128_init (struct sha3_128_ctx *ctx) -{ - memset (ctx, 0, offsetof (struct sha3_128_ctx, block)); -} - -void -sha3_128_update (struct sha3_128_ctx *ctx, size_t length, const uint8_t *data) +sha3_128_update (struct sha3_ctx *ctx, size_t length, const uint8_t *data) { - ctx->index = _nettle_sha3_update (&ctx->state, - SHA3_128_BLOCK_SIZE, ctx->block, - ctx->index, length, data); + _nettle_sha3_update (ctx, SHA3_128_BLOCK_SIZE >> 3, length, data); } void -sha3_128_shake (struct sha3_128_ctx *ctx, size_t length, uint8_t *dst) +sha3_128_shake (struct sha3_ctx *ctx, size_t length, uint8_t *dst) { - _nettle_sha3_shake (&ctx->state, sizeof (ctx->block), ctx->block, ctx->index, length, dst); - sha3_128_init (ctx); + _nettle_sha3_shake (ctx, SHA3_128_BLOCK_SIZE >> 3, length, dst); } void -sha3_128_shake_output (struct sha3_128_ctx *ctx, size_t length, uint8_t *digest) +sha3_128_shake_output (struct sha3_ctx *ctx, size_t length, uint8_t *digest) { - ctx->index = - _nettle_sha3_shake_output (&ctx->state, - sizeof (ctx->block), ctx->block, ctx->index, - length, digest); + _nettle_sha3_shake_output (ctx, SHA3_128_BLOCK_SIZE >> 3, length, digest); } diff --git a/shake256.c b/shake256.c index de72cf96..05263b6e 100644 --- a/shake256.c +++ b/shake256.c @@ -40,17 +40,13 @@ #include "sha3-internal.h" void -sha3_256_shake (struct sha3_256_ctx *ctx, size_t length, uint8_t *dst) +sha3_256_shake (struct sha3_ctx *ctx, size_t length, uint8_t *dst) { - _nettle_sha3_shake (&ctx->state, sizeof (ctx->block), ctx->block, ctx->index, length, dst); - sha3_256_init (ctx); + _nettle_sha3_shake (ctx, SHA3_256_BLOCK_SIZE >> 3, length, dst); } void -sha3_256_shake_output (struct sha3_256_ctx *ctx, size_t length, uint8_t *digest) +sha3_256_shake_output (struct sha3_ctx *ctx, size_t length, uint8_t *digest) { - ctx->index = - _nettle_sha3_shake_output (&ctx->state, - sizeof (ctx->block), ctx->block, ctx->index, - length, digest); + _nettle_sha3_shake_output (ctx, SHA3_256_BLOCK_SIZE >> 3, length, digest); } diff --git a/testsuite/eddsa-sign-test.c b/testsuite/eddsa-sign-test.c index 2ea1e4bd..1bc80c94 100644 --- a/testsuite/eddsa-sign-test.c +++ b/testsuite/eddsa-sign-test.c @@ -119,9 +119,9 @@ test_ed448_sign (const struct tstring *public, const struct tstring *msg, const struct tstring *ref) { - struct sha3_256_ctx ctx; + struct sha3_ctx ctx; - sha3_256_init (&ctx); + sha3_init (&ctx); test_eddsa_sign (&_nettle_curve448, &_nettle_ed448_shake256, &ctx, public, private, msg, ref); } diff --git a/testsuite/eddsa-verify-test.c b/testsuite/eddsa-verify-test.c index cc853a55..de850626 100644 --- a/testsuite/eddsa-verify-test.c +++ b/testsuite/eddsa-verify-test.c @@ -142,9 +142,9 @@ test_ed448 (const uint8_t *pub, const struct tstring *msg, const uint8_t *signature) { - struct sha3_256_ctx ctx; + struct sha3_ctx ctx; - sha3_256_init (&ctx); + sha3_init (&ctx); test_eddsa (&_nettle_curve448, &_nettle_ed448_shake256, &ctx, pub, msg, signature); } diff --git a/testsuite/shake128-test.c b/testsuite/shake128-test.c index fd55b4b2..d1b71de9 100644 --- a/testsuite/shake128-test.c +++ b/testsuite/shake128-test.c @@ -37,9 +37,9 @@ const struct nettle_xof nettle_shake128 = { "shake128", - sizeof(struct sha3_128_ctx), + sizeof(struct sha3_ctx), SHA3_128_BLOCK_SIZE, - (nettle_hash_init_func *) sha3_128_init, + (nettle_hash_init_func *) sha3_init, (nettle_hash_update_func *) sha3_128_update, (nettle_output_func *) sha3_128_shake, (nettle_output_func *) sha3_128_shake_output, diff --git a/testsuite/shake256-test.c b/testsuite/shake256-test.c index 93e1107e..9f5d9ced 100644 --- a/testsuite/shake256-test.c +++ b/testsuite/shake256-test.c @@ -39,9 +39,9 @@ const struct nettle_xof nettle_shake256 = { "shake256", - sizeof(struct sha3_256_ctx), + sizeof(struct sha3_ctx), SHA3_256_BLOCK_SIZE, - (nettle_hash_init_func *) sha3_256_init, + (nettle_hash_init_func *) sha3_init, (nettle_hash_update_func *) sha3_256_update, (nettle_output_func *) sha3_256_shake, (nettle_output_func *) sha3_256_shake_output, -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

2 1

[PATCH] getopt: Fix getopt/getenv signatures in declarations
by Khem Raj 22 Mar '25

22 Mar '25

GCC-15 complains about this when trying to build on musl | ../nettle-3.10.1/getopt.c:139:14: error: conflicting types for 'getenv'; have 'char *(void)' | 139 | extern char *getenv (); | | ^~~~~~ --- getopt.c | 2 +- getopt.h | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/getopt.c b/getopt.c index 9d29de7..5b89302 100644 --- a/getopt.c +++ b/getopt.c @@ -136,7 +136,7 @@ static struct _getopt_data getopt_data; whose names are inconsistent. */ #ifndef getenv -extern char *getenv (); +extern char *getenv (const char *); #endif #endif /* not __GNU_LIBRARY__ */ diff --git a/getopt.h b/getopt.h index da1a01f..ab50792 100644 --- a/getopt.h +++ b/getopt.h @@ -166,7 +166,7 @@ extern int __posix_getopt (int ___argc, char *const *___argv, # endif # endif #else /* not __GNU_LIBRARY__ */ -extern int getopt (); +extern int getopt(int, char * const [], const char *); #endif /* __GNU_LIBRARY__ */ #ifndef __need_getopt

1 0

Incompatible changes
by Niels Möller 20 Mar '25

20 Mar '25

Hi, I've decided to start doing some of the cleanup changes that will break ABI and/or API (which has been stable since nettle-3.6, released 5 years ago). I think the more interesting planned changes are listed on https://git.lysator.liu.se/nettle/nettle/-/issues, and the most disruptive one is dropping the length argument for the various _digest functions (https://git.lysator.liu.se/nettle/nettle/-/issues/5). Changes will be released as nettle-4.0. Focus will be on changes affecting libnettle, to be able to get this done in a reasonable time, but it will nevertheless imply an soname bump also for libhogweed. If needed, bug fixes will be back-ported to a compatible nettle-3 branch, for additional 3.10.x releases. If you have opinions on what breaking changes should or shouldn't be done at this time, this is a good time to speak up. If that is helpful for applications to transition, I'm open to add some preprocessor defines or headers that can be used to get API (but not ABI) compatibility with nettle 3. Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

3 6

[PATCH] SLH-DSA
by Zoltan Fridrich 24 Feb '25

24 Feb '25

Hello, I would like to contribute an implementation of SLH-DSA to Nettle. The implementation is based off of the reference sphincs+ implementation and leancrypto slh-dsa implementation. Included tests contain test vectors from leancrypto slh-dsa tests. Could you please review the attached patch and give me your feedback? Kind regards, Zoltan

4 19

FOSDEM 2025
by Niels Möller 29 Jan '25

29 Jan '25

Hi, I just want to say that I'm going to FOSDEM this year. I will also do a talk in the security devroom on Saturday, https://fosdem.org/2025/schedule/event/fosdem-2025-5661-sigsum-detecting-ro… Regards, /Niels -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

1 0

ANNOUNCE: Nettle-3.10.1
by Niels Möller 30 Dec '24

30 Dec '24

I'm happy to announce a new release of GNU Nettle, a low-level cryptographics library. This release includes a few bug fixes and portability improvements. See NEWS entries below. Users of powerpc64 are adviced to upgrade; the bugs in the powerpc64 sha256 assembly of nettle-3.10 has the potential to cause crashes due to invalid memory read accesses. It's unclear if it could be exploitable, but it seems unlikely that any exploit could do worse than denial of service. The Nettle home page can be found at https://www.lysator.liu.se/~nisse/nettle/, and the manual at https://www.lysator.liu.se/~nisse/nettle/nettle.html. The release can be downloaded from https://ftp.gnu.org/gnu/nettle/nettle-3.10.1.tar.gz https://www.lysator.liu.se/~nisse/archive/nettle-3.10.1.tar.gz Happy hacking, /Niels Möller NEWS for the Nettle 3.10.1 release This is a maintenance release, with only a few bugfixes and portability improvements. The new version is intended to be fully source and binary compatible with Nettle-3.6. The shared library names are libnettle.so.8.10 and libhogweed.so.6.10, with sonames libnettle.so.8 and libhogweed.so.6. Bug fixes: * Fix buffer overread in the new sha256 assembly for powerpc64, as well as a stack alignment issue. * Added missing nettle_mac structs for hmac-gosthash. * Fix configure test for valgrind, to not attempt to run valgrind on executables built using memory sanitizers. Optimizations: * Improved runtime detection of cpu features for OpenBSD and FreeBSD, using elf_aux_info when available. This also adds runtime detection for FreeBSD on arm64. Contributed by Brad Smith. -- Niels Möller. PGP key CB4962D070D77D7FCB8BA36271D8F1FF368C6677. Internet email is subject to wholesale government surveillance.

1 0

[PATCH v2] powerpc64/sha256: fix loading overreads by loading less and shifting
by Eric Richter 13 Sep '24

13 Sep '24

2 2

[PATCH] Add support for elf_aux_info() on OpenBSD
by Brad Smith 09 Sep '24

09 Sep '24

Signed-off-by: Brad Smith <brad(a)comstyle.com> --- configure.ac | 2 +- fat-arm64.c | 11 ++++++++++- fat-ppc.c | 12 ++++++------ 3 files changed, 17 insertions(+), 8 deletions(-) diff --git a/configure.ac b/configure.ac index 4f27e663..1f53a890 100644 --- a/configure.ac +++ b/configure.ac @@ -212,7 +212,7 @@ LSH_FUNC_ALLOCA # getenv_secure is used for fat overrides, # getline is used in the testsuite -AC_CHECK_FUNCS(secure_getenv getline) +AC_CHECK_FUNCS(secure_getenv getline elf_aux_info) ASM_WORDS_BIGENDIAN=unknown AC_C_BIGENDIAN([AC_DEFINE([WORDS_BIGENDIAN], 1) diff --git a/fat-arm64.c b/fat-arm64.c index 45cce0cc..36136078 100644 --- a/fat-arm64.c +++ b/fat-arm64.c @@ -51,6 +51,8 @@ #if USE_GETAUXVAL # include <asm/hwcap.h> # include <sys/auxv.h> +#elif defined(HAVE_ELF_AUX_INFO) +# include <sys/auxv.h> #elif defined(__OpenBSD__) # include <sys/sysctl.h> # include <machine/cpu.h> @@ -133,8 +135,15 @@ get_arm64_features (struct arm64_features *features) } else { +#if USE_GETAUXVAL || defined(HAVE_ELF_AUX_INFO) + unsigned long hwcap = 0; + #if USE_GETAUXVAL - unsigned long hwcap = getauxval(AT_HWCAP); + hwcap = getauxval(AT_HWCAP); +#elif defined(HAVE_ELF_AUX_INFO) + elf_aux_info(AT_HWCAP, &hwcap, sizeof(hwcap)); +#endif + features->have_aes = ((hwcap & (HWCAP_ASIMD | HWCAP_AES)) == (HWCAP_ASIMD | HWCAP_AES)); features->have_pmull diff --git a/fat-ppc.c b/fat-ppc.c index aaccc116..c4dae3a1 100644 --- a/fat-ppc.c +++ b/fat-ppc.c @@ -48,14 +48,14 @@ # include <asm/cputable.h> # include <sys/auxv.h> # endif -#elif defined(__FreeBSD__) +#elif defined(__FreeBSD__) || defined(__OpenBSD__) # include <machine/cpu.h> # ifdef PPC_FEATURE2_HAS_VEC_CRYPTO # define PPC_FEATURE2_VEC_CRYPTO PPC_FEATURE2_HAS_VEC_CRYPTO # endif -# if __FreeBSD__ >= 12 +# ifdef HAVE_ELF_AUX_INFO # include <sys/auxv.h> -# else +# elif !defined(__OpenBSD__) # include <sys/sysctl.h> # endif #endif @@ -129,11 +129,11 @@ get_ppc_features (struct ppc_features *features) # if USE_GETAUXVAL hwcap = getauxval(AT_HWCAP); hwcap2 = getauxval(AT_HWCAP2); -# elif defined(__FreeBSD__) -# if __FreeBSD__ >= 12 +# elif defined(__FreeBSD__) || defined(__OpenBSD__) +# ifdef HAVE_ELF_AUX_INFO elf_aux_info(AT_HWCAP, &hwcap, sizeof(hwcap)); elf_aux_info(AT_HWCAP2, &hwcap2, sizeof(hwcap2)); -# else +# elif !defined(__OpenBSD__) size_t len; len = sizeof(hwcap); sysctlbyname("hw.cpu_features", &hwcap, &len, NULL, 0); -- 2.46.0

2 5

[PATCH] powerpc64/sha256: fix loading overreads by loading less and shifting
by Eric Richter 06 Sep '24

06 Sep '24

Originally, the 16 input words were loaded with 16 individual vector load instructions. This has a side effect where the last three loads would overread 1/2/3 extra words. Fix the overread by replacing unnecessary overlapped reads with shifts. As a consequence, the constant registers for 4,8,12 can be removed, and also gain about 1~2% in performance. Signed-off-by: Eric Richter <erichte(a)linux.ibm.com> --- Some additional comments, since I agree that the loads should be fixed, but a bit of a performance anomaly appeared: I thought I had tested this exact method in a previous iteration of the patches, and saw either no change or a minor performance hit. This time around I am seeing a slight performance improvement: (This is output from a script that compares 10-iteration benchmark runs, the values in parens are the difference from just changing the loads to shifts) alg/mode min avg max ====================== ============== ============== ============== sha256 update 460.64 (+2.45) 467.99 (+6.63) 468.89 (+7.13) hmac-sha256 64 bytes 126.39 (+0.94) 126.86 (+0.14) 127.42 (+0.08) hmac-sha256 256 bytes 272.14 (+2.97) 273.07 (+2.07) 273.60 (+1.44) hmac-sha256 1024 bytes 391.52 (+2.00) 393.17 (+2.03) 395.58 (+3.13) hmac-sha256 4096 bytes 440.61 (+3.22) 442.46 (+4.50) 444.15 (+5.73) hmac-sha256 single msg 454.75 (+1.23) 457.51 (+3.85) 459.70 (+5.91) However, removing the loads for the now unused TC registers now hurts performance by about the amount gained from using the shifts: Adding this change: - li TC4, 4 - li TC8, 8 - li TC12, 12 li TC16, 16 yields the following performance values (parens are difference against the code that did not remove the li's but did use shifts): alg/mode min avg max ====================== ============== ============== ============== sha256 update 462.47 (+1.83) 462.75 (-5.24) 462.87 (-6.02) hmac-sha256 64 bytes 126.01 (-0.38) 126.69 (-0.17) 127.00 (-0.42) hmac-sha256 256 bytes 270.13 (-2.01) 271.62 (-1.44) 272.99 (-0.61) hmac-sha256 1024 bytes 390.79 (-0.73) 391.84 (-1.33) 393.04 (-2.54) hmac-sha256 4096 bytes 438.60 (-2.01) 438.83 (-3.63) 439.30 (-4.85) hmac-sha256 single msg 454.52 (-0.23) 454.63 (-2.88) 454.76 (-4.94) If I add an align after the TC16 load: li TC16, 16 + .align 4 C Load state values lxvw4x VSR(VSA), 0, STATE C VSA contains A,B,C,D lxvw4x VSR(VSE), TC16, STATE C VSE contains E,F,G,H performance comes back to about where it was before removing the TC loads (parens are compared against the previous run): alg/mode min avg max ====================== ============== ============== ============== sha256 update 468.29 (+5.82) 468.74 (+5.99) 468.86 (+5.99) hmac-sha256 64 bytes 126.51 (+0.50) 127.26 (+0.57) 127.78 (+0.78) hmac-sha256 256 bytes 273.17 (+3.04) 274.51 (+2.89) 276.24 (+3.25) hmac-sha256 1024 bytes 393.27 (+2.48) 395.18 (+3.34) 397.87 (+4.83) hmac-sha256 4096 bytes 441.08 (+2.48) 443.21 (+4.38) 445.09 (+5.79) hmac-sha256 single msg 454.41 (-0.11) 458.30 (+3.67) 460.82 (+6.06) I suspect with four li instructions, those are issued 4x in parallel, and then the subsequent (slower) lxvw4x instructions are queued 2x. By removing the other three li instructions, that li is queued with the first lxvw4x, but not the second -- causing a stall as the second lxv has to wait for the parallel queue of the li + lxv before, as it depends on the li completing first. This is only my running theory, but unfortunately I don't currently have the bandwidth to do a deep dive for a <2% performance mystery (that said, I do intend to return to this when I get the chance, I suspect other areas of the code could also use a similar level of scrutiny). Do you have any thoughts or advice on this, or is the proposed approach acceptable for now? Additional note: I did also try rearranging the LOAD macros with the shifts, as well as moving around the requisite byte-swap vperms, but did not receive any performance benefits. It appears doing the load, vperm, shift, addi in that order appears to be the fastest order. powerpc64/p8/sha256-compress-n.asm | 33 +++++++++++++----------------- 1 file changed, 14 insertions(+), 19 deletions(-) diff --git a/powerpc64/p8/sha256-compress-n.asm b/powerpc64/p8/sha256-compress-n.asm index e08ae132..d3416e2a 100644 --- a/powerpc64/p8/sha256-compress-n.asm +++ b/powerpc64/p8/sha256-compress-n.asm @@ -44,10 +44,7 @@ define(`T1', `r8') define(`TK', `r9') define(`COUNT', `r10') define(`TC0', `0') C Index instructions allow literal 0 instead of a GPR -define(`TC4', `r11') -define(`TC8', `r12') -define(`TC12', `r14') -define(`TC16', `r15') +define(`TC16', `r11') C State registers define(`VSA', `v0') @@ -187,24 +184,24 @@ define(`LOAD', ` define(`DOLOADS', ` IF_LE(`DATA_LOAD_VEC(VT0, .load_swap, T1)') LOAD(0, TC0) - LOAD(1, TC4) - LOAD(2, TC8) - LOAD(3, TC12) + vsldoi IV(1), IV(0), IV(0), 4 + vsldoi IV(2), IV(0), IV(0), 8 + vsldoi IV(3), IV(0), IV(0), 12 addi INPUT, INPUT, 16 LOAD(4, TC0) - LOAD(5, TC4) - LOAD(6, TC8) - LOAD(7, TC12) + vsldoi IV(5), IV(4), IV(4), 4 + vsldoi IV(6), IV(4), IV(4), 8 + vsldoi IV(7), IV(4), IV(4), 12 addi INPUT, INPUT, 16 LOAD(8, TC0) - LOAD(9, TC4) - LOAD(10, TC8) - LOAD(11, TC12) + vsldoi IV(9), IV(8), IV(8), 4 + vsldoi IV(10), IV(8), IV(8), 8 + vsldoi IV(11), IV(8), IV(8), 12 addi INPUT, INPUT, 16 LOAD(12, TC0) - LOAD(13, TC4) - LOAD(14, TC8) - LOAD(15, TC12) + vsldoi IV(13), IV(12), IV(12), 4 + vsldoi IV(14), IV(12), IV(12), 8 + vsldoi IV(15), IV(12), IV(12), 12 addi INPUT, INPUT, 16 ') @@ -245,10 +242,8 @@ PROLOGUE(_nettle_sha256_compress_n) stdx r14, T0, SP stdx r15, T1, SP - li TC4, 4 - li TC8, 8 - li TC12, 12 li TC16, 16 + .align 4 C Load state values lxvw4x VSR(VSA), 0, STATE C VSA contains A,B,C,D -- 2.46.0

2 2

[PATCH] powerpc64/sha256: adjust stack offset for storing non-volatile registers
by Eric Richter 30 Aug '24

30 Aug '24

According to the ABI, the stack pointer is quadword aligned, so starting the stack storage at offset -8, may cause the return address to be stepped on. Adjusting to use -16 as the starting point, which also matches other POWER assembly code. Signed-off-by: Eric Richter <erichte(a)linux.ibm.com> --- powerpc64/p8/sha256-compress-n.asm | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/powerpc64/p8/sha256-compress-n.asm b/powerpc64/p8/sha256-compress-n.asm index 309db1fa..e08ae132 100644 --- a/powerpc64/p8/sha256-compress-n.asm +++ b/powerpc64/p8/sha256-compress-n.asm @@ -216,8 +216,8 @@ PROLOGUE(_nettle_sha256_compress_n) C Store non-volatile registers - li T0, -8 - li T1, -24 + li T0, -16 + li T1, -32 stvx v20, T0, SP stvx v21, T1, SP subi T0, T0, 32 @@ -321,8 +321,8 @@ PROLOGUE(_nettle_sha256_compress_n) C Restore nonvolatile registers - li T0, -8 - li T1, -24 + li T0, -16 + li T1, -32 lvx v20, T0, SP lvx v21, T1, SP subi T0, T0, 32 -- 2.46.0

2 2

Jump to page:

2025

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

2003

2002

nettle-bugs