Commit 14e15c71 authored by Eric Biggers's avatar Eric Biggers
Browse files

lib/crypto: nh: Add NH library 

Add support for the NH "almost-universal hash function" to lib/crypto/,
specifically the variant of NH used in Adiantum.

This will replace the need for the "nhpoly1305" crypto_shash algorithm.
All the implementations of "nhpoly1305" use architecture-optimized code
only for the NH stage; they just use the generic C Poly1305 code for the
Poly1305 stage.  We can achieve the same result in a simpler way using
an (architecture-optimized) nh() function combined with code in
crypto/adiantum.c that passes the results to the Poly1305 library.

This commit begins this cleanup by adding the nh() function.  The code
is derived from crypto/nhpoly1305.c and include/crypto/nhpoly1305.h.

Link: https://lore.kernel.org/r/20251211011846.8179-2-ebiggers@kernel.org


Signed-off-by: default avatarEric Biggers <ebiggers@kernel.org>
parent ed894fac

include/crypto/nh.h

0 → 100644
+52 −0
Original line number Diff line number Diff line 
/* SPDX-License-Identifier: GPL-2.0 */

/*

 * NH hash function for Adiantum

 */



#ifndef _CRYPTO_NH_H

#define _CRYPTO_NH_H



#include <linux/types.h>



/* NH parameterization: */



/* Endianness: little */

/* Word size: 32 bits (works well on NEON, SSE2, AVX2) */



/* Stride: 2 words (optimal on ARM32 NEON; works okay on other CPUs too) */

#define NH_PAIR_STRIDE		2

#define NH_MESSAGE_UNIT		(NH_PAIR_STRIDE * 2 * sizeof(u32))



/* Num passes (Toeplitz iteration count): 4, to give ε = 2^{-128} */

#define NH_NUM_PASSES		4

#define NH_HASH_BYTES		(NH_NUM_PASSES * sizeof(u64))



/* Max message size: 1024 bytes (32x compression factor) */

#define NH_NUM_STRIDES		64

#define NH_MESSAGE_WORDS	(NH_PAIR_STRIDE * 2 * NH_NUM_STRIDES)

#define NH_MESSAGE_BYTES	(NH_MESSAGE_WORDS * sizeof(u32))

#define NH_KEY_WORDS		(NH_MESSAGE_WORDS + \

				 NH_PAIR_STRIDE * 2 * (NH_NUM_PASSES - 1))

#define NH_KEY_BYTES		(NH_KEY_WORDS * sizeof(u32))



/**

 * nh() - NH hash function for Adiantum

 * @key: The key.  @message_len + 48 bytes of it are used.  This is NH_KEY_BYTES

 *	 if @message_len has its maximum length of NH_MESSAGE_BYTES.

 * @message: The message

 * @message_len: The message length in bytes.  Must be a multiple of 16

 *		 (NH_MESSAGE_UNIT) and at most 1024 (NH_MESSAGE_BYTES).

 * @hash: (output) The resulting hash value

 *

 * Note: the pseudocode for NH in the Adiantum paper iterates over 1024-byte

 * segments of the message, computes a 32-byte hash for each, and returns all

 * the hashes concatenated together.  In contrast, this function just hashes one

 * segment and returns one hash.  It's the caller's responsibility to call this

 * function for each 1024-byte segment and collect all the hashes.

 *

 * Context: Any context.

 */

void nh(const u32 *key, const u8 *message, size_t message_len,

	__le64 hash[NH_NUM_PASSES]);



#endif /* _CRYPTO_NH_H */

lib/crypto/Kconfig

+10 −0
Original line number Diff line number Diff line
@@ -108,6 +108,16 @@ config CRYPTO_LIB_MLDSA 
	  The ML-DSA library functions.  Select this if your module uses any of

	  the functions from <crypto/mldsa.h>.



config CRYPTO_LIB_NH

	tristate

	help

	  Implementation of the NH almost-universal hash function, specifically

	  the variant of NH used in Adiantum.



config CRYPTO_LIB_NH_ARCH

	bool

	depends on CRYPTO_LIB_NH && !UML



config CRYPTO_LIB_POLY1305

	tristate

	help

lib/crypto/Makefile

+8 −0
Original line number Diff line number Diff line
@@ -131,6 +131,14 @@ libmldsa-y := mldsa.o 


################################################################################



obj-$(CONFIG_CRYPTO_LIB_NH) += libnh.o

libnh-y := nh.o

ifeq ($(CONFIG_CRYPTO_LIB_NH_ARCH),y)

CFLAGS_nh.o += -I$(src)/$(SRCARCH)

endif



################################################################################



obj-$(CONFIG_CRYPTO_LIB_POLY1305) += libpoly1305.o

libpoly1305-y := poly1305.o

ifeq ($(CONFIG_ARCH_SUPPORTS_INT128),y)

lib/crypto/nh.c

0 → 100644
+82 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

/*

 * Copyright 2018 Google LLC

 */



/*

 * Implementation of the NH almost-universal hash function, specifically the

 * variant of NH used in Adiantum.  This is *not* a cryptographic hash function.

 *

 * Reference: section 6.3 of "Adiantum: length-preserving encryption for

 * entry-level processors" (https://eprint.iacr.org/2018/720.pdf).

 */



#include <crypto/nh.h>

#include <linux/export.h>

#include <linux/kernel.h>

#include <linux/module.h>

#include <linux/unaligned.h>



#ifdef CONFIG_CRYPTO_LIB_NH_ARCH

#include "nh.h" /* $(SRCARCH)/nh.h */

#else

static bool nh_arch(const u32 *key, const u8 *message, size_t message_len,

		    __le64 hash[NH_NUM_PASSES])

{

	return false;

}

#endif



void nh(const u32 *key, const u8 *message, size_t message_len,

	__le64 hash[NH_NUM_PASSES])

{

	u64 sums[4] = { 0, 0, 0, 0 };



	if (nh_arch(key, message, message_len, hash))

		return;



	static_assert(NH_PAIR_STRIDE == 2);

	static_assert(NH_NUM_PASSES == 4);



	while (message_len) {

		u32 m0 = get_unaligned_le32(message + 0);

		u32 m1 = get_unaligned_le32(message + 4);

		u32 m2 = get_unaligned_le32(message + 8);

		u32 m3 = get_unaligned_le32(message + 12);



		sums[0] += (u64)(u32)(m0 + key[0]) * (u32)(m2 + key[2]);

		sums[1] += (u64)(u32)(m0 + key[4]) * (u32)(m2 + key[6]);

		sums[2] += (u64)(u32)(m0 + key[8]) * (u32)(m2 + key[10]);

		sums[3] += (u64)(u32)(m0 + key[12]) * (u32)(m2 + key[14]);

		sums[0] += (u64)(u32)(m1 + key[1]) * (u32)(m3 + key[3]);

		sums[1] += (u64)(u32)(m1 + key[5]) * (u32)(m3 + key[7]);

		sums[2] += (u64)(u32)(m1 + key[9]) * (u32)(m3 + key[11]);

		sums[3] += (u64)(u32)(m1 + key[13]) * (u32)(m3 + key[15]);

		key += NH_MESSAGE_UNIT / sizeof(key[0]);

		message += NH_MESSAGE_UNIT;

		message_len -= NH_MESSAGE_UNIT;

	}



	hash[0] = cpu_to_le64(sums[0]);

	hash[1] = cpu_to_le64(sums[1]);

	hash[2] = cpu_to_le64(sums[2]);

	hash[3] = cpu_to_le64(sums[3]);

}

EXPORT_SYMBOL_GPL(nh);



#ifdef nh_mod_init_arch

static int __init nh_mod_init(void)

{

	nh_mod_init_arch();

	return 0;

}

subsys_initcall(nh_mod_init);



static void __exit nh_mod_exit(void)

{

}

module_exit(nh_mod_exit);

#endif



MODULE_DESCRIPTION("NH almost-universal hash function");

MODULE_LICENSE("GPL");