Re: [PATCH] poly1305: generic C can be faster on chips with slow unaligned access

From: Eric Biggers
Date: Mon Nov 07 2016 - 14:25:14 EST

On Mon, Nov 07, 2016 at 08:02:35PM +0100, Jason A. Donenfeld wrote:
> On Mon, Nov 7, 2016 at 7:26 PM, Eric Biggers <ebiggers@xxxxxxxxxx> wrote:
> >
> > I was not referring to any users in particular, only what users could do. As an
> > example, if you did crypto_shash_update() with 32, 15, then 17 bytes, and the
> > underlying algorithm is poly1305-generic, the last block would end up
> > misaligned. This doesn't appear possible with your pseudocode because it only
> > passes in multiples of the block size until the very end. However I don't see
> > it claimed anywhere that shash API users have to do that.
> Actually it appears that crypto/poly1305_generic.c already buffers
> incoming blocks to a buffer that definitely looks aligned, to prevent
> this condition!

No it does *not* buffer all incoming blocks, which is why the source pointer can
fall out of alignment. Yes, I actually tested this. In fact this situation is
even hit, in both possible places, in the self-tests.