• Alexey Dobriyan's avatar
    crypto: sha512 - reduce stack usage to safe number · 51fc6dc8
    Alexey Dobriyan authored
    For rounds 16--79, W[i] only depends on W[i - 2], W[i - 7], W[i - 15] and W[i - 16].
    Consequently, keeping all W[80] array on stack is unnecessary,
    only 16 values are really needed.
    
    Using W[16] instead of W[80] greatly reduces stack usage
    (~750 bytes to ~340 bytes on x86_64).
    
    Line by line explanation:
    * BLEND_OP
      array is "circular" now, all indexes have to be modulo 16.
      Round number is positive, so remainder operation should be
      without surprises.
    
    * initial full message scheduling is trimmed to first 16 values which
      come from data block, the rest is calculated before it's needed.
    
    * original loop body is unrolled version of new SHA512_0_15 and
      SHA512_16_79 macros, unrolling was done to not do explicit variable
      renaming. Otherwise it's the very same code after preprocessing.
      See sha1_transform() code which does the same trick.
    
    Patch survives in-tree crypto test and original bugreport test
    (ping flood with hmac(sha512).
    
    See FIPS 180-2 for SHA-512 definition
    http://csrc.nist.gov/publications/fips/fips180-2/fips180-2withchangenotice.pdfSigned-off-by: default avatarAlexey Dobriyan <adobriyan@gmail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    51fc6dc8
sha512_generic.c 8.9 KB