On Sat, Mar 12, 2022 at 05:07:05PM -0700, Jason A. Donenfeld wrote: > Hi Eric, > > On Sat, Mar 12, 2022 at 2:39 PM Eric Biggers <ebiggers@xxxxxxxxxx> wrote: > > On Sun, Mar 06, 2022 at 09:51:23AM -0700, Jason A. Donenfeld wrote: > > > For this, we make use of SipHash-1-x on 64-bit and HalfSipHash-1-x on > > > 32-bit, which are already in use in the kernel and achieve the same > > > performance as the function they replace. It would be nice to do two > > > rounds, but we don't exactly have the CPU budget handy for that, and one > > > round alone is already sufficient. > > > > > > > I'm a bit confused by the argument here. It's not SipHash-1-x that's used > > elsewhere in the kernel, but rather SipHash-2-4. HalfSipHash-1-3 is used too > > Actually the hsiphash family of functions are aliased to SipHash-1-3 on 64-bit: > > /* Note that on 64-bit, we make HalfSipHash1-3 actually be SipHash1-3, for > * performance reasons. On 32-bit, below, we actually implement HalfSipHash1-3. > */ That isn't mentioned in Documentation/security/siphash.rst at all. It actually makes it pretty clear that hsiphash() is "HalfSipHash". > > So on 64-bit platforms it now throws away half of the pool. > > > > It should use 'u8 pool[sizeof(fast_pool->pool)]' to avoid hardcoding a size. > > Actually the commit message notes that we intentionally dump half of > it on 64bit. This is intentional. > It doesn't explain *why* it does that. Also, the code is much more important than the commit message, and there's no explanation in the code at all; it just looks like a bug. - Eric
