aboutsummaryrefslogtreecommitdiff
path: root/LICENSE
AgeCommit message (Collapse)AuthorFilesLines
2023-01-17Add optimised Aarch64 GCM.Adam Langley1-0/+1
Cost: 6.3KiB, based on the size of the .o file. (The bssl tool size doesn't really change, probably due to padding somewhere.) This code originally came from ARM but David has merged the AES-128 and AES-256 specific code into a function that works across AES sizes. Speeds from an M1 Pro: Did 16546000 AES-128-GCM (16 bytes) seal operations in 1000018us (16545702.2 ops/sec): 264.7 MB/s Did 10450500 AES-128-GCM (256 bytes) seal operations in 1000011us (10450385.0 ops/sec): 2675.3 MB/s Did 2822500 AES-128-GCM (1350 bytes) seal operations in 1000042us (2822381.5 ops/sec): 3810.2 MB/s Did 547000 AES-128-GCM (8192 bytes) seal operations in 1000826us (546548.6 ops/sec): 4477.3 MB/s Did 279000 AES-128-GCM (16384 bytes) seal operations in 1000411us (278885.4 ops/sec): 4569.3 MB/s Did 16991250 AES-256-GCM (16 bytes) seal operations in 1000001us (16991233.0 ops/sec): 271.9 MB/s Did 9257000 AES-256-GCM (256 bytes) seal operations in 1000072us (9256333.5 ops/sec): 2369.6 MB/s Did 2398000 AES-256-GCM (1350 bytes) seal operations in 1000002us (2397995.2 ops/sec): 3237.3 MB/s Did 465000 AES-256-GCM (8192 bytes) seal operations in 1001108us (464485.4 ops/sec): 3805.1 MB/s Did 240000 AES-256-GCM (16384 bytes) seal operations in 1002704us (239352.8 ops/sec): 3921.6 MB/s Did 16670000 AES-128-GCM (16 bytes) seal operations in 1000054us (16669099.9 ops/sec): 266.7 MB/s Did 11450750 AES-128-GCM (256 bytes) seal operations in 1000014us (11450589.7 ops/sec): 2931.4 MB/s Did 3830000 AES-128-GCM (1350 bytes) seal operations in 1000097us (3829628.5 ops/sec): 5170.0 MB/s Did 790000 AES-128-GCM (8192 bytes) seal operations in 1000379us (789700.7 ops/sec): 6469.2 MB/s Did 400000 AES-128-GCM (16384 bytes) seal operations in 1000980us (399608.4 ops/sec): 6547.2 MB/s Did 16877000 AES-256-GCM (16 bytes) seal operations in 1000052us (16876122.4 ops/sec): 270.0 MB/s Did 10438000 AES-256-GCM (256 bytes) seal operations in 1000067us (10437300.7 ops/sec): 2671.9 MB/s Did 3419000 AES-256-GCM (1350 bytes) seal operations in 1000158us (3418459.9 ops/sec): 4614.9 MB/s Did 698000 AES-256-GCM (8192 bytes) seal operations in 1000557us (697611.4 ops/sec): 5714.8 MB/s Did 355000 AES-256-GCM (16384 bytes) seal operations in 1001900us (354326.8 ops/sec): 5805.3 MB/s Change-Id: Id88f6e14482f09591fe95145bf4089de1ab68380 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/55926 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com>
2019-10-18Drop CECPQ2b code.fips-android-20191020Adam Langley1-23/+0
The experiment which motivated CECPQ2b has concluded (although the results haven't been published yet) and the SIKE code is causing some issues for gRPC in gprc/grpc#20100. Also, this is code size that takes up space in Android etc. Change-Id: I43b0b8c420f236c0fe9b40bf2517d2fde98495d5 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/38384 Reviewed-by: David Benjamin <davidben@google.com> Commit-Queue: David Benjamin <davidben@google.com>
2019-05-16Add support for SIKE/p503 post-quantum KEMKris Kwiatkowski1-0/+23
Based on Microsoft's implementation available on github: Source: https://github.com/Microsoft/PQCrypto-SIDH Commit: 77044b76181eb61c744ac8eb7ddc7a8fe72f6919 Following changes has been applied * In intel assembly, use MOV instead of MOVQ: Intel instruction reference in the Intel Software Developer's Manual volume 2A, the MOVQ has 4 forms. None of them mentions moving literal to GPR, hence "movq $rax, 0x0" is wrong. Instead, on 64bit system, MOV can be used. * Some variables were wrongly zero-initialized (as per C99 spec). * Rewrite x86_64 assembly to AT&T format. * Move assembly for x86_64 and aarch64 to perlasm. * Changes to aarch64 assembly, to avoid using x18 platform register. Assembly also correctly constructs linked list of stack-frames as described in AAPCS64, 5.2.3. * Move constant values to .RODATA segment, as keeping them in .TEXT segment is not compatible with XOM. * Fixes issue in arm64 code related to the fact that compiler doesn't reserve enough space for the linker to relocate address of a global variable when used by 'ldr' instructions. Solution is to use 'adrp' followed by 'add' instruction. Relocations for 'adrp' and 'add' instructions is generated by prefixing the label with :pg_hi21: and :lo12: respectively. * Enable MULX and ADX. Code from MS doesn't support PIC. MULX can't reference global variable directly. Instead RIP-relative addressing can be used. This improves performance around 10%-13% on SkyLake * Check if CPU supports BMI2 and ADOX instruction at runtime. On AMD64 optimized implementation of montgomery multiplication and reduction have 2 implementations - faster one takes advantage of BMI2 instruction set introduced in Haswell and ADOX introduced in Broadwell. Thanks to OPENSSL_ia32cap_P it can be decided at runtime which implementation to choose. As CPU configuration is static by nature, branch predictor will be correct most of the time and hence this check very often has no cost. * Reuse some utilities from boringssl instead of reimplementing them. This includes things like: * definition of a limb size (use crypto_word_t instead of digit_t) * use functions for checking in constant time if value is 0 and/or less then * #define's used for conditional compilation * Use SSE2 for conditional swap on vector registers. Improves performance a little bit. * Fix f2elm_t definition. Code imported from MSR defines f2elm_t type as a array of arrays. This decays to a pointer to an array (when passing as an argument). In C, one can't assign const pointer to an array with non-const pointer to an array. Seems it violates 6.7.3/8 from C99 (same for C11). This problem occures in GCC 6, only when -pedantic flag is specified and it occures always in GCC 4.9 (debian jessie). * Fix definition of eval_3_isog. Second argument in eval_3_isog mustn't be const. Similar reason as above. * Use HMAC-SHA256 instead of cSHAKE-256 to avoid upstreaming cSHAKE and SHA3 code. * Add speed and unit tests for SIKE. Some speed results: Skylake (64-bit): Did 408 SIKE/P503 generate operations in 1002573us (407.0 ops/sec) Did 275 SIKE/P503 encap operations in 1070570us (256.9 ops/sec) Did 264 SIKE/P503 decap operations in 1098955us (240.2 ops/sec) Skylake (32-bit): Did 9 SIKE/P503 generate operations in 1051620us (8.6 ops/sec) Did 5 SIKE/P503 encap operations in 1038251us (4.8 ops/sec) Did 5 SIKE/P503 decap operations in 1103617us (4.5 ops/sec) Change-Id: I22f0bb1f9edff314a35cd74b48e8c4962568e330 Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/35204 Reviewed-by: Adam Langley <alangley@gmail.com>
2018-03-27Note licenses for support code in the top-level LICENSE file.Adam Langley1-0/+70
This keeps some scripts happy. Change-Id: I79be4f3d014b72fbe3f0793759ad2b42329a550c Reviewed-on: https://boringssl-review.googlesource.com/26824 Commit-Queue: David Benjamin <davidben@google.com> Reviewed-by: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2018-02-12Merge Intel copyright notice into standardDavid Benjamin1-40/+3
This was done by OpenSSL with the kind permission of Intel. This change is imported from upstream's commit dcf6e50f48e6bab92dcd2dacb27fc17c0de34199. Change-Id: Ie8d3b700cd527a6e8cf66e0728051b2acd8cc6b9 Reviewed-on: https://boringssl-review.googlesource.com/25588 Commit-Queue: David Benjamin <davidben@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2017-11-03curve25519: fiat-crypto field arithmetic.Adam Langley1-1/+26
Each operation was translated from fiat-crypto output using fiat-crypto prettyprint.py. For example fe_mul is synthesized in https://github.com/mit-plv/fiat-crypto/blob/master/src/Specific/X25519/C32/femul.v, and shown in the last Coq-compatible form at https://github.com/mit-plv/fiat-crypto/blob/master/src/Specific/X25519/C32/femulDisplay.log. Benchmarks on Google Cloud's unidentified Intel Xeon with AVX2: git checkout $VARIANT && ( cd build && rm -rf * && CC=clang CXX=clang++ cmake -GNinja -DCMAKE_TOOLCHAIN_FILE=../util/32-bit-toolchain.cmake -DCMAKE_BUILD_TYPE=Release .. && ninja && ./tool/bssl speed -filter 25519 ) this branch: Did 11382 Ed25519 key generation operations in 1053046us (10808.6 ops/sec) Did 11169 Ed25519 signing operations in 1038080us (10759.3 ops/sec) Did 2925 Ed25519 verify operations in 1001346us (2921.1 ops/sec) Did 12000 Curve25519 base-point multiplication operations in 1084851us (11061.4 ops/sec) Did 3850 Curve25519 arbitrary point multiplication operations in 1085565us (3546.5 ops/sec) Did 11466 Ed25519 key generation operations in 1049821us (10921.9 ops/sec) Did 11000 Ed25519 signing operations in 1013317us (10855.4 ops/sec) Did 3047 Ed25519 verify operations in 1043846us (2919.0 ops/sec) Did 12000 Curve25519 base-point multiplication operations in 1068924us (11226.2 ops/sec) Did 3850 Curve25519 arbitrary point multiplication operations in 1090598us (3530.2 ops/sec) Did 10309 Ed25519 key generation operations in 1003320us (10274.9 ops/sec) Did 11000 Ed25519 signing operations in 1017862us (10807.0 ops/sec) Did 3135 Ed25519 verify operations in 1098624us (2853.6 ops/sec) Did 9000 Curve25519 base-point multiplication operations in 1046608us (8599.2 ops/sec) Did 3132 Curve25519 arbitrary point multiplication operations in 1038963us (3014.5 ops/sec) master: Did 11564 Ed25519 key generation operations in 1068762us (10820.0 ops/sec) Did 11104 Ed25519 signing operations in 1024278us (10840.8 ops/sec) Did 3206 Ed25519 verify operations in 1049179us (3055.7 ops/sec) Did 12000 Curve25519 base-point multiplication operations in 1073619us (11177.1 ops/sec) Did 3550 Curve25519 arbitrary point multiplication operations in 1000279us (3549.0 ops/sec) andreser@linux-andreser:~/boringssl$ build/tool/bssl speed -filter 25519 Did 11760 Ed25519 key generation operations in 1072495us (10965.1 ops/sec) Did 10800 Ed25519 signing operations in 1003486us (10762.5 ops/sec) Did 3245 Ed25519 verify operations in 1080399us (3003.5 ops/sec) Did 12000 Curve25519 base-point multiplication operations in 1076021us (11152.2 ops/sec) Did 3570 Curve25519 arbitrary point multiplication operations in 1005087us (3551.9 ops/sec) andreser@linux-andreser:~/boringssl$ build/tool/bssl speed -filter 25519 Did 11438 Ed25519 key generation operations in 1041115us (10986.3 ops/sec) Did 11000 Ed25519 signing operations in 1012589us (10863.2 ops/sec) Did 3312 Ed25519 verify operations in 1082834us (3058.6 ops/sec) Did 12000 Curve25519 base-point multiplication operations in 1061318us (11306.7 ops/sec) Did 3580 Curve25519 arbitrary point multiplication operations in 1004923us (3562.5 ops/sec) squashed: curve25519: convert field constants to unsigned. import re, sys, math def weight(i): return 2**int(math.ceil(25.5*i)) def convert(t): limbs = [x for x in t.groups() if x.replace('-','').isdigit()] v = sum(weight(i)*x for (i,x) in enumerate(map(int, limbs))) % (2**255-19) limbs = [(v % weight(i+1)) // weight(i) for i in range(10)] assert v == sum(weight(i)*x for (i,x) in enumerate(limbs)) i = 0 ret = '' for s in t.groups(): if s.replace('-','').isdigit(): ret += str(limbs[i]) i += 1 else: ret += s return ret fe_re = re.compile(r'(\s*,\s*)'.join(r'(-?\d+)' for i in range(10))) print (re.sub(fe_re, convert, sys.stdin.read())) Change-Id: Ibd4f7f5c38e5c4d61c9826afb406baebe2be5168 Reviewed-on: https://boringssl-review.googlesource.com/22385 Reviewed-by: Adam Langley <agl@google.com> Commit-Queue: Adam Langley <agl@google.com> CQ-Verified: CQ bot account: commit-bot@chromium.org <commit-bot@chromium.org>
2017-11-03Move curve25519 code to third_party/fiat.Andres Erbsen1-1/+2
This change doesn't actually introduce any Fiat code yet. It sets up the directory structure to make the diffs in the next change clearer. Change-Id: I38a21fb36b18a08b0907f9d37b7ef5d7d3137ede Reviewed-on: https://boringssl-review.googlesource.com/22624 Reviewed-by: David Benjamin <davidben@google.com>
2016-02-22Add some bug references to the LICENSE file.Adam Langley1-0/+7
Add references for some cases where we have explicit permission from authors to use their work. This is just to make things easy for us to find. Change-Id: I47dacc6a80f9d0c960c5b6713a8dc25e1a4e6f0b Reviewed-on: https://boringssl-review.googlesource.com/7191 Reviewed-by: David Benjamin <davidben@google.com>
2015-07-28Note that some files carry in Intel license.Adam Langley1-0/+39
The following files have their own license at the top of them: crypto/bn/asm/rsaz-avx2.pl crypto/bn/asm/rsaz-x86_64.pl crypto/bn/rsaz_exp.c crypto/bn/rsaz_exp.h This change notes this separate license in the top-level LICENSE file. Change-Id: I3e134346ad454edd276b053990f56b384dfd0d57 Reviewed-on: https://boringssl-review.googlesource.com/5500 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
2015-05-20Add LICENSE file.Adam Langley1-0/+146
Change-Id: I1bade6ad22596857b208b2c8ad54b239b648b86e Reviewed-on: https://boringssl-review.googlesource.com/4812 Reviewed-by: David Benjamin <davidben@chromium.org> Reviewed-by: Adam Langley <agl@google.com>
generated by cgit v1.1 at 2024-07-23 17:55:22 +0000