)]}' { "commit": "ad5f68f99414df3f6c9d4ceb4b9a43efcf8c8c1e", "tree": "ab333c52eddda742d868c475208692a10bea1c02", "parents": [ "6c712523cab8661ac5cc71ff4b05612f03ed5054" ], "author": { "name": "David Benjamin", "email": "davidben@google.com", "time": "Mon Dec 15 15:19:50 2025 -0500" }, "committer": { "name": "Boringssl LUCI CQ", "email": "boringssl-scoped@luci-project-accounts.iam.gserviceaccount.com", "time": "Tue Dec 16 08:07:52 2025 -0800" }, "message": "Pass a slightly smaller upper bound to TLS CBC MAC calculation\n\nWhen compute the MAC for TLS CBC ciphers, we need to be constant-time up\nto a range of data lens. The wider that range, the more blocks we run\nthrough the slower-constant-time path.\n\nGiven a MAC length of M (20 bytes for SHA-1 and 32 bytes for SHA-256)\nand ciphertext length C (C a multiple of 16 and at least M+1 bytes),\nboth public, the minimum plaintext length is C - M - 256.\n\nWe use a maximum plaintext length of P_max \u003d C, but the plaintext is\nactually upper-bounded at P_max \u003d C - M. Switch to the more accurate\nestimate.\n\nThis doesn\u0027t help for all inputs. For it to be a non-trivial\nimprovement, we need to do one fewer hash block at C - M than we would\nhave done with the weaker estimate.\n\nComputing the hash blocks is tricky because we\u0027re actually hashing\nL \u003d 13 + P_max bytes. Additionally, SHA-1 and SHA-256 internally\nincorporate a length and padding into their final block. Hashing L bytes\nruns the compression function ceil((L + 9) / 64) times.\n\nIn all, we run the compression function ceil((P_max + 22) / 64) times.\nRunning those numbers, for SHA-1, we should expect an improvement when\nC mod 64 is 48. For SHA-256, it\u0027s when C mod 64 is 0 or 48.\n\nThis matches the benchmarks below. Note that InputSize here is the\nactual plaintext. The corresponding ciphertext length is\nC \u003d RoundUp(P + M + 1, 16).\n\n(Actually P_max \u003d C - M - 1 would be an even more accurate upper bound,\nbut that gets a little odd with how bad padding gets mapped to\npadding_length \u003d 0 instead of padding_length \u003d 1. It also wouldn\u0027t\nchange the above.)\n\nBenchmark Time CPU Time Old Time New CPU Old CPU New\n-------------------------------------------------------------------------------------------------------------------------------------------------\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:64 -0.0008 -0.0006 1101 1100 1101 1100\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:72 -0.0053 -0.0054 1106 1100 1106 1100\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:80 -0.1113 -0.1114 1297 1153 1297 1152\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:88 -0.1121 -0.1122 1298 1152 1297 1152\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:96 -0.0037 -0.0039 1346 1341 1346 1340\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:104 -0.0032 -0.0032 1352 1347 1351 1347\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:112 +0.0033 +0.0033 1391 1396 1391 1396\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:120 +0.0013 +0.0013 1395 1396 1394 1396\nBM_SpeedAEAD/open_aes_128_cbc_sha1/InputSize:128 +0.0030 +0.0029 1440 1444 1440 1444\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:64 -0.1168 -0.1171 1894 1673 1894 1672\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:72 -0.1171 -0.1171 1892 1670 1892 1670\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:80 -0.1130 -0.1137 1942 1723 1942 1721\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:88 -0.1130 -0.1140 1945 1725 1944 1722\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:96 +0.0036 +0.0019 2001 2008 2001 2005\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:104 +0.0033 +0.0021 2000 2007 1999 2003\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:112 -0.0087 -0.0102 2082 2064 2081 2060\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:120 +0.0059 +0.0042 2052 2064 2052 2061\nBM_SpeedAEAD/open_aes_128_cbc_sha256/InputSize:128 -0.0918 -0.0927 2325 2111 2323 2108\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:64 +0.0019 +0.0003 1106 1108 1106 1106\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:72 -0.0016 -0.0022 1107 1105 1107 1105\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:80 -0.1060 -0.1060 1299 1161 1299 1161\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:88 -0.1076 -0.1077 1299 1159 1299 1159\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:96 -0.0020 -0.0020 1349 1346 1349 1346\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:104 -0.0021 -0.0020 1349 1347 1349 1346\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:112 -0.0002 -0.0004 1409 1408 1408 1408\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:120 -0.0007 -0.0011 1411 1410 1411 1409\nBM_SpeedAEAD/open_aes_256_cbc_sha1/InputSize:128 +0.0043 +0.0027 1458 1464 1457 1461\n\nChange-Id: I540febad01b02c8593343ebf8dadee3bd0e8b9ba\nReviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/85647\nReviewed-by: Rudolf Polzer \u003crpolzer@google.com\u003e\nCommit-Queue: David Benjamin \u003cdavidben@google.com\u003e\n", "tree_diff": [ { "type": "modify", "old_id": "9e83afbcd023572747df02336b8e2224c583093e", "old_mode": 33188, "old_path": "crypto/cipher/e_tls.cc", "new_id": "f7223abb21deb06dade1100058d60dafb08335e2", "new_mode": 33188, "new_path": "crypto/cipher/e_tls.cc" }, { "type": "modify", "old_id": "ed09f4b4cc9486309f47abda1ddb62a238d7b973", "old_mode": 33188, "old_path": "crypto/cipher/internal.h", "new_id": "20af987cc456554f134cdaef79d1604fbad7ef8a", "new_mode": 33188, "new_path": "crypto/cipher/internal.h" } ] }