mirror of
https://github.com/bitcoin/bitcoin.git
synced 2026-09-12 05:32:22 +02:00
refactor: simplify adding SipHash-1-3-UJ
Move the SipHash round, compression, and finalization operations shared by `CSipHasher` and `PresaltedSipHasher` into inline `SipHashState` methods. This centralizes state mutation, preserves the existing byte-path code generation, and keeps the security-sensitive follow-up focused on its changed block compression, round counts, and finalizer. Co-authored-by: Pieter Wuille <pieter@wuille.net>
This commit is contained in:
Lőrinc
@@ -6,64 +6,36 @@
|
||||
|
||||
#include <uint256.h>
|
||||
|
||||
#include <bit>
|
||||
#include <cassert>
|
||||
#include <span>
|
||||
|
||||
#define SIPROUND do { \
|
||||
v0 += v1; v1 = std::rotl(v1, 13); v1 ^= v0; \
|
||||
v0 = std::rotl(v0, 32); \
|
||||
v2 += v3; v3 = std::rotl(v3, 16); v3 ^= v2; \
|
||||
v0 += v3; v3 = std::rotl(v3, 21); v3 ^= v0; \
|
||||
v2 += v1; v1 = std::rotl(v1, 17); v1 ^= v2; \
|
||||
v2 = std::rotl(v2, 32); \
|
||||
} while (0)
|
||||
|
||||
CSipHasher::CSipHasher(uint64_t k0, uint64_t k1) : m_state{k0, k1} {}
|
||||
|
||||
CSipHasher& CSipHasher::Write(uint64_t data)
|
||||
{
|
||||
uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3];
|
||||
|
||||
assert(m_count % 8 == 0);
|
||||
|
||||
v3 ^= data;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= data;
|
||||
|
||||
m_state.v[0] = v0;
|
||||
m_state.v[1] = v1;
|
||||
m_state.v[2] = v2;
|
||||
m_state.v[3] = v3;
|
||||
|
||||
m_state.Compress2(data);
|
||||
m_count += 8;
|
||||
return *this;
|
||||
}
|
||||
|
||||
CSipHasher& CSipHasher::Write(std::span<const unsigned char> data)
|
||||
{
|
||||
uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3];
|
||||
uint64_t t = m_tmp;
|
||||
uint8_t c = m_count;
|
||||
SipHashState state{m_state.Copy()};
|
||||
uint64_t t{m_tmp};
|
||||
uint8_t c{m_count};
|
||||
|
||||
while (data.size() > 0) {
|
||||
t |= uint64_t{data.front()} << (8 * (c % 8));
|
||||
c++;
|
||||
if ((c & 7) == 0) {
|
||||
v3 ^= t;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= t;
|
||||
state.Compress2(t);
|
||||
t = 0;
|
||||
}
|
||||
data = data.subspan(1);
|
||||
}
|
||||
|
||||
m_state.v[0] = v0;
|
||||
m_state.v[1] = v1;
|
||||
m_state.v[2] = v2;
|
||||
m_state.v[3] = v3;
|
||||
m_state = state;
|
||||
m_count = c;
|
||||
m_tmp = t;
|
||||
|
||||
@@ -72,91 +44,29 @@ CSipHasher& CSipHasher::Write(std::span<const unsigned char> data)
|
||||
|
||||
uint64_t CSipHasher::Finalize() const
|
||||
{
|
||||
uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3];
|
||||
|
||||
uint64_t t = m_tmp | (((uint64_t)m_count) << 56);
|
||||
|
||||
v3 ^= t;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= t;
|
||||
v2 ^= 0xFF;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
return v0 ^ v1 ^ v2 ^ v3;
|
||||
return m_state.Copy()
|
||||
.Compress2(m_tmp | (uint64_t{m_count} << 56))
|
||||
.Finalize4();
|
||||
}
|
||||
|
||||
uint64_t PresaltedSipHasher::operator()(const uint256& val) const noexcept
|
||||
{
|
||||
uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3];
|
||||
uint64_t d = val.GetUint64(0);
|
||||
v3 ^= d;
|
||||
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(1);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(2);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(3);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
v3 ^= (uint64_t{4}) << 59;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= (uint64_t{4}) << 59;
|
||||
v2 ^= 0xFF;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
return v0 ^ v1 ^ v2 ^ v3;
|
||||
return m_state.Copy()
|
||||
.Compress2(val.GetUint64(0))
|
||||
.Compress2(val.GetUint64(1))
|
||||
.Compress2(val.GetUint64(2))
|
||||
.Compress2(val.GetUint64(3))
|
||||
.Compress2(uint64_t{32} << 56)
|
||||
.Finalize4();
|
||||
}
|
||||
|
||||
/** Specialized implementation for efficiency */
|
||||
uint64_t PresaltedSipHasher::operator()(const uint256& val, uint32_t extra) const noexcept
|
||||
{
|
||||
uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3];
|
||||
uint64_t d = val.GetUint64(0);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(1);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(2);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = val.GetUint64(3);
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
d = ((uint64_t{36}) << 56) | extra;
|
||||
v3 ^= d;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
v0 ^= d;
|
||||
v2 ^= 0xFF;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
SIPROUND;
|
||||
return v0 ^ v1 ^ v2 ^ v3;
|
||||
return m_state.Copy()
|
||||
.Compress2(val.GetUint64(0))
|
||||
.Compress2(val.GetUint64(1))
|
||||
.Compress2(val.GetUint64(2))
|
||||
.Compress2(val.GetUint64(3))
|
||||
.Compress2((uint64_t{36} << 56) | extra)
|
||||
.Finalize4();
|
||||
}
|
||||
|
||||
@@ -5,21 +5,63 @@
|
||||
#ifndef BITCOIN_CRYPTO_SIPHASH_H
|
||||
#define BITCOIN_CRYPTO_SIPHASH_H
|
||||
|
||||
#include <array>
|
||||
#include <attributes.h>
|
||||
#include <uint256.h>
|
||||
|
||||
#include <bit>
|
||||
#include <cstdint>
|
||||
#include <span>
|
||||
|
||||
class uint256;
|
||||
|
||||
/** Shared SipHash internal state v[0..3], initialized from (k0, k1). */
|
||||
/** Shared SipHash state (v0..v3) with its round, compression, and finalization primitives.
|
||||
* Internal building block, only meant to be composed by the hasher classes below. */
|
||||
class SipHashState
|
||||
{
|
||||
static constexpr uint64_t C0{0x736f6d6570736575ULL}, C1{0x646f72616e646f6dULL}, C2{0x6c7967656e657261ULL}, C3{0x7465646279746573ULL};
|
||||
/** SipHash initialization constants. */
|
||||
static constexpr uint64_t C0{0x736f6d6570736575}, C1{0x646f72616e646f6d}, C2{0x6c7967656e657261}, C3{0x7465646279746573};
|
||||
/** SipHash v2 finalizer constant. */
|
||||
static constexpr uint64_t FINALIZER{0xFF};
|
||||
|
||||
/** Construct a SipHashState with the specified values as state. */
|
||||
ALWAYS_INLINE SipHashState(uint64_t v0, uint64_t v1, uint64_t v2, uint64_t v3) noexcept : m_v0{v0}, m_v1{v1}, m_v2{v2}, m_v3{v3} {}
|
||||
|
||||
/** State variables. */
|
||||
uint64_t m_v0, m_v1, m_v2, m_v3;
|
||||
|
||||
/** Mutably perform one SipRound on this state. */
|
||||
ALWAYS_INLINE void SipRound() noexcept
|
||||
{
|
||||
m_v0 += m_v1; m_v1 = std::rotl(m_v1, 13); m_v1 ^= m_v0;
|
||||
m_v0 = std::rotl(m_v0, 32);
|
||||
m_v2 += m_v3; m_v3 = std::rotl(m_v3, 16); m_v3 ^= m_v2;
|
||||
m_v0 += m_v3; m_v3 = std::rotl(m_v3, 21); m_v3 ^= m_v0;
|
||||
m_v2 += m_v1; m_v1 = std::rotl(m_v1, 17); m_v1 ^= m_v2;
|
||||
m_v2 = std::rotl(m_v2, 32);
|
||||
}
|
||||
|
||||
public:
|
||||
explicit SipHashState(uint64_t k0, uint64_t k1) noexcept : v{C0 ^ k0, C1 ^ k1, C2 ^ k0, C3 ^ k1} {}
|
||||
|
||||
std::array<uint64_t, 4> v{};
|
||||
/** Construct a SipHashState initialized with the specified key. */
|
||||
explicit ALWAYS_INLINE SipHashState(uint64_t k0, uint64_t k1) noexcept : SipHashState{C0 ^ k0, C1 ^ k1, C2 ^ k0, C3 ^ k1} {}
|
||||
/** Construct a copy of this state. */
|
||||
ALWAYS_INLINE SipHashState Copy() const noexcept { return {m_v0, m_v1, m_v2, m_v3}; }
|
||||
/** Mutably compress one block into this state, with 2 SipRounds. */
|
||||
ALWAYS_INLINE SipHashState& Compress2(uint64_t data) noexcept
|
||||
{
|
||||
m_v3 ^= data;
|
||||
SipRound();
|
||||
SipRound();
|
||||
m_v0 ^= data;
|
||||
return *this;
|
||||
}
|
||||
/** Mutably finalize this state with 4 SipRounds, and return the resulting hash. */
|
||||
ALWAYS_INLINE uint64_t Finalize4() noexcept
|
||||
{
|
||||
m_v2 ^= FINALIZER;
|
||||
SipRound();
|
||||
SipRound();
|
||||
SipRound();
|
||||
SipRound();
|
||||
return m_v0 ^ m_v1 ^ m_v2 ^ m_v3;
|
||||
}
|
||||
};
|
||||
|
||||
/** General SipHash-2-4 implementation. */
|
||||
@@ -46,7 +88,7 @@ public:
|
||||
/**
|
||||
* Optimized SipHash-2-4 implementation for uint256.
|
||||
*
|
||||
* This class caches the initial SipHash v[0..3] state derived from (k0, k1)
|
||||
* This class caches the initial SipHash state (v0..v3) derived from (k0, k1)
|
||||
* and implements a specialized hashing path for uint256 values, with or
|
||||
* without an extra 32-bit word. The internal state is immutable, so
|
||||
* PresaltedSipHasher instances can be reused for multiple hashes with the
|
||||
|
||||
Reference in New Issue
Block a user