From e55573583685eda80dd33d85ab2cea59b86332c5 Mon Sep 17 00:00:00 2001 From: "brian m. carlson" Date: Sun, 10 Jul 2022 13:29:07 +0000 Subject: sha256: add support for Nettle For SHA-256, we currently have support for OpenSSL and libgcrypt because these two libraries contain optimized implementations that can take advantage of native processor instructions. However, OpenSSL is not suitable for linking against for Linux distros due to licensing incompatibilities with the GPLv2, and libgcrypt has been less favored by cryptographers due to some security-related implementation issues, which, while not affecting our use of hash algorithms, has affected its reputation. Let's add another option that's compatible with the GPLv2, which is Nettle. This is an option which is generally better than libgcrypt because on many distros GnuTLS (which uses Nettle) is used for HTTPS and therefore as a practical matter it will be available on most systems. As a result, prefer it over libgcrypt and our built-in implementation. Nettle also has recently gained support for Intel's SHA-NI instructions, which compare very favorably to other implementations, as well as assembly implementations for when SHA-NI is not available. A git gc on git.git sees a 12% performance improvement with Nettle over our block SHA-256 implementation due to general assembly improvements. With SHA-NI, the performance of raw SHA-256 on a 2 GiB file goes from 7.296 seconds with block SHA-256 to 1.523 seconds with Nettle. Signed-off-by: brian m. carlson Signed-off-by: Junio C Hamano --- sha256/nettle.h | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 sha256/nettle.h (limited to 'sha256') diff --git a/sha256/nettle.h b/sha256/nettle.h new file mode 100644 index 0000000000..b63e1c8190 --- /dev/null +++ b/sha256/nettle.h @@ -0,0 +1,31 @@ +#ifndef SHA256_NETTLE_H +#define SHA256_NETTLE_H + +#include + +typedef struct sha256_ctx nettle_SHA256_CTX; + +static inline void nettle_SHA256_Init(nettle_SHA256_CTX *ctx) +{ + sha256_init(ctx); +} + +static inline void nettle_SHA256_Update(nettle_SHA256_CTX *ctx, + const void *data, + size_t len) +{ + sha256_update(ctx, len, data); +} + +static inline void nettle_SHA256_Final(unsigned char *digest, + nettle_SHA256_CTX *ctx) +{ + sha256_digest(ctx, SHA256_DIGEST_SIZE, digest); +} + +#define platform_SHA256_CTX nettle_SHA256_CTX +#define platform_SHA256_Init nettle_SHA256_Init +#define platform_SHA256_Update nettle_SHA256_Update +#define platform_SHA256_Final nettle_SHA256_Final + +#endif -- cgit v1.2.3