2022-05-18 16:23:45 +03:00
|
|
|
// SPDX-License-Identifier: (GPL-2.0-only OR BSD-3-Clause)
|
|
|
|
/* Copyright (C) 2016-2022 Jason A. Donenfeld <Jason@zx2c4.com>. All Rights Reserved.
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
*
|
|
|
|
* SipHash: a fast short-input PRF
|
|
|
|
* https://131002.net/siphash/
|
|
|
|
*
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
* This implementation is specifically for SipHash2-4 for a secure PRF
|
|
|
|
* and HalfSipHash1-3/SipHash1-3 for an insecure PRF only suitable for
|
|
|
|
* hashtables.
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/siphash.h>
|
|
|
|
#include <asm/unaligned.h>
|
|
|
|
|
|
|
|
#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64
|
|
|
|
#include <linux/dcache.h>
|
|
|
|
#include <asm/word-at-a-time.h>
|
|
|
|
#endif
|
|
|
|
|
2022-05-07 15:03:46 +03:00
|
|
|
#define SIPROUND SIPHASH_PERMUTATION(v0, v1, v2, v3)
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
|
|
|
|
#define PREAMBLE(len) \
|
2022-05-07 15:03:46 +03:00
|
|
|
u64 v0 = SIPHASH_CONST_0; \
|
|
|
|
u64 v1 = SIPHASH_CONST_1; \
|
|
|
|
u64 v2 = SIPHASH_CONST_2; \
|
|
|
|
u64 v3 = SIPHASH_CONST_3; \
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
u64 b = ((u64)(len)) << 56; \
|
|
|
|
v3 ^= key->key[1]; \
|
|
|
|
v2 ^= key->key[0]; \
|
|
|
|
v1 ^= key->key[1]; \
|
|
|
|
v0 ^= key->key[0];
|
|
|
|
|
|
|
|
#define POSTAMBLE \
|
|
|
|
v3 ^= b; \
|
|
|
|
SIPROUND; \
|
|
|
|
SIPROUND; \
|
|
|
|
v0 ^= b; \
|
|
|
|
v2 ^= 0xff; \
|
|
|
|
SIPROUND; \
|
|
|
|
SIPROUND; \
|
|
|
|
SIPROUND; \
|
|
|
|
SIPROUND; \
|
|
|
|
return (v0 ^ v1) ^ (v2 ^ v3);
|
|
|
|
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
u64 __siphash_aligned(const void *data, size_t len, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u64));
|
|
|
|
const u8 left = len & (sizeof(u64) - 1);
|
|
|
|
u64 m;
|
|
|
|
PREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u64)) {
|
|
|
|
m = le64_to_cpup(data);
|
|
|
|
v3 ^= m;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64
|
|
|
|
if (left)
|
|
|
|
b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) &
|
|
|
|
bytemask_from_count(left)));
|
|
|
|
#else
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 7: b |= ((u64)end[6]) << 48; fallthrough;
|
|
|
|
case 6: b |= ((u64)end[5]) << 40; fallthrough;
|
|
|
|
case 5: b |= ((u64)end[4]) << 32; fallthrough;
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
case 4: b |= le32_to_cpup(data); break;
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u64)end[2]) << 16; fallthrough;
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
case 2: b |= le16_to_cpup(data); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__siphash_aligned);
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#endif
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
|
|
|
|
u64 __siphash_unaligned(const void *data, size_t len, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u64));
|
|
|
|
const u8 left = len & (sizeof(u64) - 1);
|
|
|
|
u64 m;
|
|
|
|
PREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u64)) {
|
|
|
|
m = get_unaligned_le64(data);
|
|
|
|
v3 ^= m;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64
|
|
|
|
if (left)
|
|
|
|
b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) &
|
|
|
|
bytemask_from_count(left)));
|
|
|
|
#else
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 7: b |= ((u64)end[6]) << 48; fallthrough;
|
|
|
|
case 6: b |= ((u64)end[5]) << 40; fallthrough;
|
|
|
|
case 5: b |= ((u64)end[4]) << 32; fallthrough;
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
case 4: b |= get_unaligned_le32(end); break;
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u64)end[2]) << 16; fallthrough;
|
siphash: add cryptographically secure PRF
SipHash is a 64-bit keyed hash function that is actually a
cryptographically secure PRF, like HMAC. Except SipHash is super fast,
and is meant to be used as a hashtable keyed lookup function, or as a
general PRF for short input use cases, such as sequence numbers or RNG
chaining.
For the first usage:
There are a variety of attacks known as "hashtable poisoning" in which an
attacker forms some data such that the hash of that data will be the
same, and then preceeds to fill up all entries of a hashbucket. This is
a realistic and well-known denial-of-service vector. Currently
hashtables use jhash, which is fast but not secure, and some kind of
rotating key scheme (or none at all, which isn't good). SipHash is meant
as a replacement for jhash in these cases.
There are a modicum of places in the kernel that are vulnerable to
hashtable poisoning attacks, either via userspace vectors or network
vectors, and there's not a reliable mechanism inside the kernel at the
moment to fix it. The first step toward fixing these issues is actually
getting a secure primitive into the kernel for developers to use. Then
we can, bit by bit, port things over to it as deemed appropriate.
While SipHash is extremely fast for a cryptographically secure function,
it is likely a bit slower than the insecure jhash, and so replacements
will be evaluated on a case-by-case basis based on whether or not the
difference in speed is negligible and whether or not the current jhash usage
poses a real security risk.
For the second usage:
A few places in the kernel are using MD5 or SHA1 for creating secure
sequence numbers, syn cookies, port numbers, or fast random numbers.
SipHash is a faster and more fitting, and more secure replacement for MD5
in those situations. Replacing MD5 and SHA1 with SipHash for these uses is
obvious and straight-forward, and so is submitted along with this patch
series. There shouldn't be much of a debate over its efficacy.
Dozens of languages are already using this internally for their hash
tables and PRFs. Some of the BSDs already use this in their kernels.
SipHash is a widely known high-speed solution to a widely known set of
problems, and it's time we catch-up.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Eric Biggers <ebiggers3@gmail.com>
Cc: David Laight <David.Laight@aculab.com>
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:00 +03:00
|
|
|
case 2: b |= get_unaligned_le16(end); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__siphash_unaligned);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* siphash_1u64 - compute 64-bit siphash PRF value of a u64
|
|
|
|
* @first: first u64
|
|
|
|
* @key: the siphash key
|
|
|
|
*/
|
|
|
|
u64 siphash_1u64(const u64 first, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
PREAMBLE(8)
|
|
|
|
v3 ^= first;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_1u64);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* siphash_2u64 - compute 64-bit siphash PRF value of 2 u64
|
|
|
|
* @first: first u64
|
|
|
|
* @second: second u64
|
|
|
|
* @key: the siphash key
|
|
|
|
*/
|
|
|
|
u64 siphash_2u64(const u64 first, const u64 second, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
PREAMBLE(16)
|
|
|
|
v3 ^= first;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_2u64);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* siphash_3u64 - compute 64-bit siphash PRF value of 3 u64
|
|
|
|
* @first: first u64
|
|
|
|
* @second: second u64
|
|
|
|
* @third: third u64
|
|
|
|
* @key: the siphash key
|
|
|
|
*/
|
|
|
|
u64 siphash_3u64(const u64 first, const u64 second, const u64 third,
|
|
|
|
const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
PREAMBLE(24)
|
|
|
|
v3 ^= first;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
v3 ^= third;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= third;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_3u64);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* siphash_4u64 - compute 64-bit siphash PRF value of 4 u64
|
|
|
|
* @first: first u64
|
|
|
|
* @second: second u64
|
|
|
|
* @third: third u64
|
|
|
|
* @forth: forth u64
|
|
|
|
* @key: the siphash key
|
|
|
|
*/
|
|
|
|
u64 siphash_4u64(const u64 first, const u64 second, const u64 third,
|
|
|
|
const u64 forth, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
PREAMBLE(32)
|
|
|
|
v3 ^= first;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
v3 ^= third;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= third;
|
|
|
|
v3 ^= forth;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= forth;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_4u64);
|
|
|
|
|
|
|
|
u64 siphash_1u32(const u32 first, const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
PREAMBLE(4)
|
|
|
|
b |= first;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_1u32);
|
|
|
|
|
|
|
|
u64 siphash_3u32(const u32 first, const u32 second, const u32 third,
|
|
|
|
const siphash_key_t *key)
|
|
|
|
{
|
|
|
|
u64 combined = (u64)second << 32 | first;
|
|
|
|
PREAMBLE(12)
|
|
|
|
v3 ^= combined;
|
|
|
|
SIPROUND;
|
|
|
|
SIPROUND;
|
|
|
|
v0 ^= combined;
|
|
|
|
b |= third;
|
|
|
|
POSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(siphash_3u32);
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
|
|
|
|
#if BITS_PER_LONG == 64
|
|
|
|
/* Note that on 64-bit, we make HalfSipHash1-3 actually be SipHash1-3, for
|
|
|
|
* performance reasons. On 32-bit, below, we actually implement HalfSipHash1-3.
|
|
|
|
*/
|
|
|
|
|
|
|
|
#define HSIPROUND SIPROUND
|
|
|
|
#define HPREAMBLE(len) PREAMBLE(len)
|
|
|
|
#define HPOSTAMBLE \
|
|
|
|
v3 ^= b; \
|
|
|
|
HSIPROUND; \
|
|
|
|
v0 ^= b; \
|
|
|
|
v2 ^= 0xff; \
|
|
|
|
HSIPROUND; \
|
|
|
|
HSIPROUND; \
|
|
|
|
HSIPROUND; \
|
|
|
|
return (v0 ^ v1) ^ (v2 ^ v3);
|
|
|
|
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u64));
|
|
|
|
const u8 left = len & (sizeof(u64) - 1);
|
|
|
|
u64 m;
|
|
|
|
HPREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u64)) {
|
|
|
|
m = le64_to_cpup(data);
|
|
|
|
v3 ^= m;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64
|
|
|
|
if (left)
|
|
|
|
b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) &
|
|
|
|
bytemask_from_count(left)));
|
|
|
|
#else
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 7: b |= ((u64)end[6]) << 48; fallthrough;
|
|
|
|
case 6: b |= ((u64)end[5]) << 40; fallthrough;
|
|
|
|
case 5: b |= ((u64)end[4]) << 32; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 4: b |= le32_to_cpup(data); break;
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u64)end[2]) << 16; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 2: b |= le16_to_cpup(data); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__hsiphash_aligned);
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#endif
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
|
|
|
|
u32 __hsiphash_unaligned(const void *data, size_t len,
|
|
|
|
const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u64));
|
|
|
|
const u8 left = len & (sizeof(u64) - 1);
|
|
|
|
u64 m;
|
|
|
|
HPREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u64)) {
|
|
|
|
m = get_unaligned_le64(data);
|
|
|
|
v3 ^= m;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
#if defined(CONFIG_DCACHE_WORD_ACCESS) && BITS_PER_LONG == 64
|
|
|
|
if (left)
|
|
|
|
b |= le64_to_cpu((__force __le64)(load_unaligned_zeropad(data) &
|
|
|
|
bytemask_from_count(left)));
|
|
|
|
#else
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 7: b |= ((u64)end[6]) << 48; fallthrough;
|
|
|
|
case 6: b |= ((u64)end[5]) << 40; fallthrough;
|
|
|
|
case 5: b |= ((u64)end[4]) << 32; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 4: b |= get_unaligned_le32(end); break;
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u64)end[2]) << 16; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 2: b |= get_unaligned_le16(end); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
#endif
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__hsiphash_unaligned);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_1u32 - compute 64-bit hsiphash PRF value of a u32
|
|
|
|
* @first: first u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_1u32(const u32 first, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
HPREAMBLE(4)
|
|
|
|
b |= first;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_1u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_2u32 - compute 32-bit hsiphash PRF value of 2 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_2u32(const u32 first, const u32 second, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
u64 combined = (u64)second << 32 | first;
|
|
|
|
HPREAMBLE(8)
|
|
|
|
v3 ^= combined;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= combined;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_2u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_3u32 - compute 32-bit hsiphash PRF value of 3 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @third: third u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_3u32(const u32 first, const u32 second, const u32 third,
|
|
|
|
const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
u64 combined = (u64)second << 32 | first;
|
|
|
|
HPREAMBLE(12)
|
|
|
|
v3 ^= combined;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= combined;
|
|
|
|
b |= third;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_3u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_4u32 - compute 32-bit hsiphash PRF value of 4 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @third: third u32
|
|
|
|
* @forth: forth u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_4u32(const u32 first, const u32 second, const u32 third,
|
|
|
|
const u32 forth, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
u64 combined = (u64)second << 32 | first;
|
|
|
|
HPREAMBLE(16)
|
|
|
|
v3 ^= combined;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= combined;
|
|
|
|
combined = (u64)forth << 32 | third;
|
|
|
|
v3 ^= combined;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= combined;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_4u32);
|
|
|
|
#else
|
2022-05-07 15:03:46 +03:00
|
|
|
#define HSIPROUND HSIPHASH_PERMUTATION(v0, v1, v2, v3)
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
|
|
|
|
#define HPREAMBLE(len) \
|
2022-05-07 15:03:46 +03:00
|
|
|
u32 v0 = HSIPHASH_CONST_0; \
|
|
|
|
u32 v1 = HSIPHASH_CONST_1; \
|
|
|
|
u32 v2 = HSIPHASH_CONST_2; \
|
|
|
|
u32 v3 = HSIPHASH_CONST_3; \
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
u32 b = ((u32)(len)) << 24; \
|
|
|
|
v3 ^= key->key[1]; \
|
|
|
|
v2 ^= key->key[0]; \
|
|
|
|
v1 ^= key->key[1]; \
|
|
|
|
v0 ^= key->key[0];
|
|
|
|
|
|
|
|
#define HPOSTAMBLE \
|
|
|
|
v3 ^= b; \
|
|
|
|
HSIPROUND; \
|
|
|
|
v0 ^= b; \
|
|
|
|
v2 ^= 0xff; \
|
|
|
|
HSIPROUND; \
|
|
|
|
HSIPROUND; \
|
|
|
|
HSIPROUND; \
|
|
|
|
return v1 ^ v3;
|
|
|
|
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#ifndef CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
u32 __hsiphash_aligned(const void *data, size_t len, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u32));
|
|
|
|
const u8 left = len & (sizeof(u32) - 1);
|
|
|
|
u32 m;
|
|
|
|
HPREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u32)) {
|
|
|
|
m = le32_to_cpup(data);
|
|
|
|
v3 ^= m;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u32)end[2]) << 16; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 2: b |= le16_to_cpup(data); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__hsiphash_aligned);
|
siphash: use _unaligned version by default
On ARM v6 and later, we define CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS
because the ordinary load/store instructions (ldr, ldrh, ldrb) can
tolerate any misalignment of the memory address. However, load/store
double and load/store multiple instructions (ldrd, ldm) may still only
be used on memory addresses that are 32-bit aligned, and so we have to
use the CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS macro with care, or we
may end up with a severe performance hit due to alignment traps that
require fixups by the kernel. Testing shows that this currently happens
with clang-13 but not gcc-11. In theory, any compiler version can
produce this bug or other problems, as we are dealing with undefined
behavior in C99 even on architectures that support this in hardware,
see also https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100363.
Fortunately, the get_unaligned() accessors do the right thing: when
building for ARMv6 or later, the compiler will emit unaligned accesses
using the ordinary load/store instructions (but avoid the ones that
require 32-bit alignment). When building for older ARM, those accessors
will emit the appropriate sequence of ldrb/mov/orr instructions. And on
architectures that can truly tolerate any kind of misalignment, the
get_unaligned() accessors resolve to the leXX_to_cpup accessors that
operate on aligned addresses.
Since the compiler will in fact emit ldrd or ldm instructions when
building this code for ARM v6 or later, the solution is to use the
unaligned accessors unconditionally on architectures where this is
known to be fast. The _aligned version of the hash function is
however still needed to get the best performance on architectures
that cannot do any unaligned access in hardware.
This new version avoids the undefined behavior and should produce
the fastest hash on all architectures we support.
Link: https://lore.kernel.org/linux-arm-kernel/20181008211554.5355-4-ard.biesheuvel@linaro.org/
Link: https://lore.kernel.org/linux-crypto/CAK8P3a2KfmmGDbVHULWevB0hv71P2oi2ZCHEAqT=8dQfa0=cqQ@mail.gmail.com/
Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Fixes: 2c956a60778c ("siphash: add cryptographically secure PRF")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Jason A. Donenfeld <Jason@zx2c4.com>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2021-11-29 18:39:29 +03:00
|
|
|
#endif
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
|
|
|
|
u32 __hsiphash_unaligned(const void *data, size_t len,
|
|
|
|
const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
const u8 *end = data + len - (len % sizeof(u32));
|
|
|
|
const u8 left = len & (sizeof(u32) - 1);
|
|
|
|
u32 m;
|
|
|
|
HPREAMBLE(len)
|
|
|
|
for (; data != end; data += sizeof(u32)) {
|
|
|
|
m = get_unaligned_le32(data);
|
|
|
|
v3 ^= m;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= m;
|
|
|
|
}
|
|
|
|
switch (left) {
|
2020-11-16 07:35:31 +03:00
|
|
|
case 3: b |= ((u32)end[2]) << 16; fallthrough;
|
siphash: implement HalfSipHash1-3 for hash tables
HalfSipHash, or hsiphash, is a shortened version of SipHash, which
generates 32-bit outputs using a weaker 64-bit key. It has *much* lower
security margins, and shouldn't be used for anything too sensitive, but
it could be used as a hashtable key function replacement, if the output
is never exposed, and if the security requirement is not too high.
The goal is to make this something that performance-critical jhash users
would be willing to use.
On 64-bit machines, HalfSipHash1-3 is slower than SipHash1-3, so we alias
SipHash1-3 to HalfSipHash1-3 on those systems.
64-bit x86_64:
[ 0.509409] test_siphash: SipHash2-4 cycles: 4049181
[ 0.510650] test_siphash: SipHash1-3 cycles: 2512884
[ 0.512205] test_siphash: HalfSipHash1-3 cycles: 3429920
[ 0.512904] test_siphash: JenkinsHash cycles: 978267
So, we map hsiphash() -> SipHash1-3
32-bit x86:
[ 0.509868] test_siphash: SipHash2-4 cycles: 14812892
[ 0.513601] test_siphash: SipHash1-3 cycles: 9510710
[ 0.515263] test_siphash: HalfSipHash1-3 cycles: 3856157
[ 0.515952] test_siphash: JenkinsHash cycles: 1148567
So, we map hsiphash() -> HalfSipHash1-3
hsiphash() is roughly 3 times slower than jhash(), but comes with a
considerable security improvement.
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Jean-Philippe Aumasson <jeanphilippe.aumasson@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-01-08 15:54:01 +03:00
|
|
|
case 2: b |= get_unaligned_le16(end); break;
|
|
|
|
case 1: b |= end[0];
|
|
|
|
}
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(__hsiphash_unaligned);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_1u32 - compute 32-bit hsiphash PRF value of a u32
|
|
|
|
* @first: first u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_1u32(const u32 first, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
HPREAMBLE(4)
|
|
|
|
v3 ^= first;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_1u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_2u32 - compute 32-bit hsiphash PRF value of 2 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_2u32(const u32 first, const u32 second, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
HPREAMBLE(8)
|
|
|
|
v3 ^= first;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_2u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_3u32 - compute 32-bit hsiphash PRF value of 3 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @third: third u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_3u32(const u32 first, const u32 second, const u32 third,
|
|
|
|
const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
HPREAMBLE(12)
|
|
|
|
v3 ^= first;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
v3 ^= third;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= third;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_3u32);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* hsiphash_4u32 - compute 32-bit hsiphash PRF value of 4 u32
|
|
|
|
* @first: first u32
|
|
|
|
* @second: second u32
|
|
|
|
* @third: third u32
|
|
|
|
* @forth: forth u32
|
|
|
|
* @key: the hsiphash key
|
|
|
|
*/
|
|
|
|
u32 hsiphash_4u32(const u32 first, const u32 second, const u32 third,
|
|
|
|
const u32 forth, const hsiphash_key_t *key)
|
|
|
|
{
|
|
|
|
HPREAMBLE(16)
|
|
|
|
v3 ^= first;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= first;
|
|
|
|
v3 ^= second;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= second;
|
|
|
|
v3 ^= third;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= third;
|
|
|
|
v3 ^= forth;
|
|
|
|
HSIPROUND;
|
|
|
|
v0 ^= forth;
|
|
|
|
HPOSTAMBLE
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL(hsiphash_4u32);
|
|
|
|
#endif
|