From 25bfca06d6698663310f692ed64dd4ff8e2fc962 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?L=C5=91rinc?= Date: Wed, 15 Jul 2026 15:54:18 -0700 Subject: [PATCH] refactor: simplify adding SipHash-1-3-UJ Move the SipHash round, compression, and finalization operations shared by `CSipHasher` and `PresaltedSipHasher` into inline `SipHashState` methods. This centralizes state mutation, preserves the existing byte-path code generation, and keeps the security-sensitive follow-up focused on its changed block compression, round counts, and finalizer. Co-authored-by: Pieter Wuille --- src/crypto/siphash.cpp | 136 +++++++---------------------------------- src/crypto/siphash.h | 60 +++++++++++++++--- 2 files changed, 74 insertions(+), 122 deletions(-) diff --git a/src/crypto/siphash.cpp b/src/crypto/siphash.cpp index 89dbad6f44f..4c3f3b9db5e 100644 --- a/src/crypto/siphash.cpp +++ b/src/crypto/siphash.cpp @@ -6,64 +6,36 @@ #include -#include #include #include -#define SIPROUND do { \ - v0 += v1; v1 = std::rotl(v1, 13); v1 ^= v0; \ - v0 = std::rotl(v0, 32); \ - v2 += v3; v3 = std::rotl(v3, 16); v3 ^= v2; \ - v0 += v3; v3 = std::rotl(v3, 21); v3 ^= v0; \ - v2 += v1; v1 = std::rotl(v1, 17); v1 ^= v2; \ - v2 = std::rotl(v2, 32); \ -} while (0) - CSipHasher::CSipHasher(uint64_t k0, uint64_t k1) : m_state{k0, k1} {} CSipHasher& CSipHasher::Write(uint64_t data) { - uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3]; - assert(m_count % 8 == 0); - - v3 ^= data; - SIPROUND; - SIPROUND; - v0 ^= data; - - m_state.v[0] = v0; - m_state.v[1] = v1; - m_state.v[2] = v2; - m_state.v[3] = v3; - + m_state.Compress2(data); m_count += 8; return *this; } CSipHasher& CSipHasher::Write(std::span data) { - uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3]; - uint64_t t = m_tmp; - uint8_t c = m_count; + SipHashState state{m_state.Copy()}; + uint64_t t{m_tmp}; + uint8_t c{m_count}; while (data.size() > 0) { t |= uint64_t{data.front()} << (8 * (c % 8)); c++; if ((c & 7) == 0) { - v3 ^= t; - SIPROUND; - SIPROUND; - v0 ^= t; + state.Compress2(t); t = 0; } data = data.subspan(1); } - m_state.v[0] = v0; - m_state.v[1] = v1; - m_state.v[2] = v2; - m_state.v[3] = v3; + m_state = state; m_count = c; m_tmp = t; @@ -72,91 +44,29 @@ CSipHasher& CSipHasher::Write(std::span data) uint64_t CSipHasher::Finalize() const { - uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3]; - - uint64_t t = m_tmp | (((uint64_t)m_count) << 56); - - v3 ^= t; - SIPROUND; - SIPROUND; - v0 ^= t; - v2 ^= 0xFF; - SIPROUND; - SIPROUND; - SIPROUND; - SIPROUND; - return v0 ^ v1 ^ v2 ^ v3; + return m_state.Copy() + .Compress2(m_tmp | (uint64_t{m_count} << 56)) + .Finalize4(); } uint64_t PresaltedSipHasher::operator()(const uint256& val) const noexcept { - uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3]; - uint64_t d = val.GetUint64(0); - v3 ^= d; - - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(1); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(2); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(3); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - v3 ^= (uint64_t{4}) << 59; - SIPROUND; - SIPROUND; - v0 ^= (uint64_t{4}) << 59; - v2 ^= 0xFF; - SIPROUND; - SIPROUND; - SIPROUND; - SIPROUND; - return v0 ^ v1 ^ v2 ^ v3; + return m_state.Copy() + .Compress2(val.GetUint64(0)) + .Compress2(val.GetUint64(1)) + .Compress2(val.GetUint64(2)) + .Compress2(val.GetUint64(3)) + .Compress2(uint64_t{32} << 56) + .Finalize4(); } -/** Specialized implementation for efficiency */ uint64_t PresaltedSipHasher::operator()(const uint256& val, uint32_t extra) const noexcept { - uint64_t v0 = m_state.v[0], v1 = m_state.v[1], v2 = m_state.v[2], v3 = m_state.v[3]; - uint64_t d = val.GetUint64(0); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(1); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(2); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = val.GetUint64(3); - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - d = ((uint64_t{36}) << 56) | extra; - v3 ^= d; - SIPROUND; - SIPROUND; - v0 ^= d; - v2 ^= 0xFF; - SIPROUND; - SIPROUND; - SIPROUND; - SIPROUND; - return v0 ^ v1 ^ v2 ^ v3; + return m_state.Copy() + .Compress2(val.GetUint64(0)) + .Compress2(val.GetUint64(1)) + .Compress2(val.GetUint64(2)) + .Compress2(val.GetUint64(3)) + .Compress2((uint64_t{36} << 56) | extra) + .Finalize4(); } diff --git a/src/crypto/siphash.h b/src/crypto/siphash.h index 2f28473a4f1..5bcc6d45536 100644 --- a/src/crypto/siphash.h +++ b/src/crypto/siphash.h @@ -5,21 +5,63 @@ #ifndef BITCOIN_CRYPTO_SIPHASH_H #define BITCOIN_CRYPTO_SIPHASH_H -#include +#include +#include + +#include #include #include -class uint256; - -/** Shared SipHash internal state v[0..3], initialized from (k0, k1). */ +/** Shared SipHash state (v0..v3) with its round, compression, and finalization primitives. + * Internal building block, only meant to be composed by the hasher classes below. */ class SipHashState { - static constexpr uint64_t C0{0x736f6d6570736575ULL}, C1{0x646f72616e646f6dULL}, C2{0x6c7967656e657261ULL}, C3{0x7465646279746573ULL}; + /** SipHash initialization constants. */ + static constexpr uint64_t C0{0x736f6d6570736575}, C1{0x646f72616e646f6d}, C2{0x6c7967656e657261}, C3{0x7465646279746573}; + /** SipHash v2 finalizer constant. */ + static constexpr uint64_t FINALIZER{0xFF}; + + /** Construct a SipHashState with the specified values as state. */ + ALWAYS_INLINE SipHashState(uint64_t v0, uint64_t v1, uint64_t v2, uint64_t v3) noexcept : m_v0{v0}, m_v1{v1}, m_v2{v2}, m_v3{v3} {} + + /** State variables. */ + uint64_t m_v0, m_v1, m_v2, m_v3; + + /** Mutably perform one SipRound on this state. */ + ALWAYS_INLINE void SipRound() noexcept + { + m_v0 += m_v1; m_v1 = std::rotl(m_v1, 13); m_v1 ^= m_v0; + m_v0 = std::rotl(m_v0, 32); + m_v2 += m_v3; m_v3 = std::rotl(m_v3, 16); m_v3 ^= m_v2; + m_v0 += m_v3; m_v3 = std::rotl(m_v3, 21); m_v3 ^= m_v0; + m_v2 += m_v1; m_v1 = std::rotl(m_v1, 17); m_v1 ^= m_v2; + m_v2 = std::rotl(m_v2, 32); + } public: - explicit SipHashState(uint64_t k0, uint64_t k1) noexcept : v{C0 ^ k0, C1 ^ k1, C2 ^ k0, C3 ^ k1} {} - - std::array v{}; + /** Construct a SipHashState initialized with the specified key. */ + explicit ALWAYS_INLINE SipHashState(uint64_t k0, uint64_t k1) noexcept : SipHashState{C0 ^ k0, C1 ^ k1, C2 ^ k0, C3 ^ k1} {} + /** Construct a copy of this state. */ + ALWAYS_INLINE SipHashState Copy() const noexcept { return {m_v0, m_v1, m_v2, m_v3}; } + /** Mutably compress one block into this state, with 2 SipRounds. */ + ALWAYS_INLINE SipHashState& Compress2(uint64_t data) noexcept + { + m_v3 ^= data; + SipRound(); + SipRound(); + m_v0 ^= data; + return *this; + } + /** Mutably finalize this state with 4 SipRounds, and return the resulting hash. */ + ALWAYS_INLINE uint64_t Finalize4() noexcept + { + m_v2 ^= FINALIZER; + SipRound(); + SipRound(); + SipRound(); + SipRound(); + return m_v0 ^ m_v1 ^ m_v2 ^ m_v3; + } }; /** General SipHash-2-4 implementation. */ @@ -46,7 +88,7 @@ public: /** * Optimized SipHash-2-4 implementation for uint256. * - * This class caches the initial SipHash v[0..3] state derived from (k0, k1) + * This class caches the initial SipHash state (v0..v3) derived from (k0, k1) * and implements a specialized hashing path for uint256 values, with or * without an extra 32-bit word. The internal state is immutable, so * PresaltedSipHasher instances can be reused for multiple hashes with the