Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
lib/crypto: nh: Add NH library
Add support for the NH "almost-universal hash function" to lib/crypto/,
specifically the variant of NH used in Adiantum.
This will replace the need for the "nhpoly1305" crypto_shash algorithm.
All the implementations of "nhpoly1305" use architecture-optimized code
only for the NH stage; they just use the generic C Poly1305 code for the
Poly1305 stage. We can achieve the same result in a simpler way using
an (architecture-optimized) nh() function combined with code in
crypto/adiantum.c that passes the results to the Poly1305 library.
This commit begins this cleanup by adding the nh() function. The code
is derived from crypto/nhpoly1305.c and include/crypto/nhpoly1305.h.
Link: https://lore.kernel.org/r/20251211011846.8179-2-ebiggers@kernel.org
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
+152
+52
include/crypto/nh.h
+52
include/crypto/nh.h
···
1
+
/* SPDX-License-Identifier: GPL-2.0 */
2
+
/*
3
+
* NH hash function for Adiantum
4
+
*/
5
+
6
+
#ifndef _CRYPTO_NH_H
7
+
#define _CRYPTO_NH_H
8
+
9
+
#include <linux/types.h>
10
+
11
+
/* NH parameterization: */
12
+
13
+
/* Endianness: little */
14
+
/* Word size: 32 bits (works well on NEON, SSE2, AVX2) */
15
+
16
+
/* Stride: 2 words (optimal on ARM32 NEON; works okay on other CPUs too) */
17
+
#define NH_PAIR_STRIDE 2
18
+
#define NH_MESSAGE_UNIT (NH_PAIR_STRIDE * 2 * sizeof(u32))
19
+
20
+
/* Num passes (Toeplitz iteration count): 4, to give ε = 2^{-128} */
21
+
#define NH_NUM_PASSES 4
22
+
#define NH_HASH_BYTES (NH_NUM_PASSES * sizeof(u64))
23
+
24
+
/* Max message size: 1024 bytes (32x compression factor) */
25
+
#define NH_NUM_STRIDES 64
26
+
#define NH_MESSAGE_WORDS (NH_PAIR_STRIDE * 2 * NH_NUM_STRIDES)
27
+
#define NH_MESSAGE_BYTES (NH_MESSAGE_WORDS * sizeof(u32))
28
+
#define NH_KEY_WORDS (NH_MESSAGE_WORDS + \
29
+
NH_PAIR_STRIDE * 2 * (NH_NUM_PASSES - 1))
30
+
#define NH_KEY_BYTES (NH_KEY_WORDS * sizeof(u32))
31
+
32
+
/**
33
+
* nh() - NH hash function for Adiantum
34
+
* @key: The key. @message_len + 48 bytes of it are used. This is NH_KEY_BYTES
35
+
* if @message_len has its maximum length of NH_MESSAGE_BYTES.
36
+
* @message: The message
37
+
* @message_len: The message length in bytes. Must be a multiple of 16
38
+
* (NH_MESSAGE_UNIT) and at most 1024 (NH_MESSAGE_BYTES).
39
+
* @hash: (output) The resulting hash value
40
+
*
41
+
* Note: the pseudocode for NH in the Adiantum paper iterates over 1024-byte
42
+
* segments of the message, computes a 32-byte hash for each, and returns all
43
+
* the hashes concatenated together. In contrast, this function just hashes one
44
+
* segment and returns one hash. It's the caller's responsibility to call this
45
+
* function for each 1024-byte segment and collect all the hashes.
46
+
*
47
+
* Context: Any context.
48
+
*/
49
+
void nh(const u32 *key, const u8 *message, size_t message_len,
50
+
__le64 hash[NH_NUM_PASSES]);
51
+
52
+
#endif /* _CRYPTO_NH_H */
+10
lib/crypto/Kconfig
+10
lib/crypto/Kconfig
···
108
108
The ML-DSA library functions. Select this if your module uses any of
109
109
the functions from <crypto/mldsa.h>.
110
110
111
+
config CRYPTO_LIB_NH
112
+
tristate
113
+
help
114
+
Implementation of the NH almost-universal hash function, specifically
115
+
the variant of NH used in Adiantum.
116
+
117
+
config CRYPTO_LIB_NH_ARCH
118
+
bool
119
+
depends on CRYPTO_LIB_NH && !UML
120
+
111
121
config CRYPTO_LIB_POLY1305
112
122
tristate
113
123
help
+8
lib/crypto/Makefile
+8
lib/crypto/Makefile
···
131
131
132
132
################################################################################
133
133
134
+
obj-$(CONFIG_CRYPTO_LIB_NH) += libnh.o
135
+
libnh-y := nh.o
136
+
ifeq ($(CONFIG_CRYPTO_LIB_NH_ARCH),y)
137
+
CFLAGS_nh.o += -I$(src)/$(SRCARCH)
138
+
endif
139
+
140
+
################################################################################
141
+
134
142
obj-$(CONFIG_CRYPTO_LIB_POLY1305) += libpoly1305.o
135
143
libpoly1305-y := poly1305.o
136
144
ifeq ($(CONFIG_ARCH_SUPPORTS_INT128),y)
+82
lib/crypto/nh.c
+82
lib/crypto/nh.c
···
1
+
// SPDX-License-Identifier: GPL-2.0
2
+
/*
3
+
* Copyright 2018 Google LLC
4
+
*/
5
+
6
+
/*
7
+
* Implementation of the NH almost-universal hash function, specifically the
8
+
* variant of NH used in Adiantum. This is *not* a cryptographic hash function.
9
+
*
10
+
* Reference: section 6.3 of "Adiantum: length-preserving encryption for
11
+
* entry-level processors" (https://eprint.iacr.org/2018/720.pdf).
12
+
*/
13
+
14
+
#include <crypto/nh.h>
15
+
#include <linux/export.h>
16
+
#include <linux/kernel.h>
17
+
#include <linux/module.h>
18
+
#include <linux/unaligned.h>
19
+
20
+
#ifdef CONFIG_CRYPTO_LIB_NH_ARCH
21
+
#include "nh.h" /* $(SRCARCH)/nh.h */
22
+
#else
23
+
static bool nh_arch(const u32 *key, const u8 *message, size_t message_len,
24
+
__le64 hash[NH_NUM_PASSES])
25
+
{
26
+
return false;
27
+
}
28
+
#endif
29
+
30
+
void nh(const u32 *key, const u8 *message, size_t message_len,
31
+
__le64 hash[NH_NUM_PASSES])
32
+
{
33
+
u64 sums[4] = { 0, 0, 0, 0 };
34
+
35
+
if (nh_arch(key, message, message_len, hash))
36
+
return;
37
+
38
+
static_assert(NH_PAIR_STRIDE == 2);
39
+
static_assert(NH_NUM_PASSES == 4);
40
+
41
+
while (message_len) {
42
+
u32 m0 = get_unaligned_le32(message + 0);
43
+
u32 m1 = get_unaligned_le32(message + 4);
44
+
u32 m2 = get_unaligned_le32(message + 8);
45
+
u32 m3 = get_unaligned_le32(message + 12);
46
+
47
+
sums[0] += (u64)(u32)(m0 + key[0]) * (u32)(m2 + key[2]);
48
+
sums[1] += (u64)(u32)(m0 + key[4]) * (u32)(m2 + key[6]);
49
+
sums[2] += (u64)(u32)(m0 + key[8]) * (u32)(m2 + key[10]);
50
+
sums[3] += (u64)(u32)(m0 + key[12]) * (u32)(m2 + key[14]);
51
+
sums[0] += (u64)(u32)(m1 + key[1]) * (u32)(m3 + key[3]);
52
+
sums[1] += (u64)(u32)(m1 + key[5]) * (u32)(m3 + key[7]);
53
+
sums[2] += (u64)(u32)(m1 + key[9]) * (u32)(m3 + key[11]);
54
+
sums[3] += (u64)(u32)(m1 + key[13]) * (u32)(m3 + key[15]);
55
+
key += NH_MESSAGE_UNIT / sizeof(key[0]);
56
+
message += NH_MESSAGE_UNIT;
57
+
message_len -= NH_MESSAGE_UNIT;
58
+
}
59
+
60
+
hash[0] = cpu_to_le64(sums[0]);
61
+
hash[1] = cpu_to_le64(sums[1]);
62
+
hash[2] = cpu_to_le64(sums[2]);
63
+
hash[3] = cpu_to_le64(sums[3]);
64
+
}
65
+
EXPORT_SYMBOL_GPL(nh);
66
+
67
+
#ifdef nh_mod_init_arch
68
+
static int __init nh_mod_init(void)
69
+
{
70
+
nh_mod_init_arch();
71
+
return 0;
72
+
}
73
+
subsys_initcall(nh_mod_init);
74
+
75
+
static void __exit nh_mod_exit(void)
76
+
{
77
+
}
78
+
module_exit(nh_mod_exit);
79
+
#endif
80
+
81
+
MODULE_DESCRIPTION("NH almost-universal hash function");
82
+
MODULE_LICENSE("GPL");