aboutsummaryrefslogtreecommitdiff
path: root/lib/std/crypto/aegis.zig
AgeCommit message (Collapse)Author
2025-08-28std.Io: delete GenericWriterAndrew Kelley
2025-08-13std.crypto.aegis: Absorb ad instead of encrypting it.Erik Schlyter
`Aegis256XGeneric` behaves differently than `Aegis128XGeneric` in that it currently encrypts associated data instead of just absorbing it. Even though the end result is the same, there's no point in encrypting and copying the ad into a buffer that gets overwritten anyway. This fix makes `Aegis256XGeneric` behave the same as `Aegis128XGeneric`.
2025-07-13std.crypto: remove `inline` from most functionsAndrew Kelley
To quote the language reference, It is generally better to let the compiler decide when to inline a function, except for these scenarios: * To change how many stack frames are in the call stack, for debugging purposes. * To force comptime-ness of the arguments to propagate to the return value of the function, as in the above example. * Real world performance measurements demand it. Don't guess! Note that inline actually restricts what the compiler is allowed to do. This can harm binary size, compilation speed, and even runtime performance. `zig run lib/std/crypto/benchmark.zig -OReleaseFast` [-before-] vs {+after+} md5: [-990-] {+998+} MiB/s sha1: [-1144-] {+1140+} MiB/s sha256: [-2267-] {+2275+} MiB/s sha512: [-762-] {+767+} MiB/s sha3-256: [-680-] {+683+} MiB/s sha3-512: [-362-] {+363+} MiB/s shake-128: [-835-] {+839+} MiB/s shake-256: [-680-] {+681+} MiB/s turboshake-128: [-1567-] {+1570+} MiB/s turboshake-256: [-1276-] {+1282+} MiB/s blake2s: [-778-] {+789+} MiB/s blake2b: [-1071-] {+1086+} MiB/s blake3: [-1148-] {+1137+} MiB/s ghash: [-10044-] {+10033+} MiB/s polyval: [-9726-] {+10033+} MiB/s poly1305: [-2486-] {+2703+} MiB/s hmac-md5: [-991-] {+998+} MiB/s hmac-sha1: [-1134-] {+1137+} MiB/s hmac-sha256: [-2265-] {+2288+} MiB/s hmac-sha512: [-765-] {+764+} MiB/s siphash-2-4: [-4410-] {+4438+} MiB/s siphash-1-3: [-7144-] {+7225+} MiB/s siphash128-2-4: [-4397-] {+4449+} MiB/s siphash128-1-3: [-7281-] {+7374+} MiB/s aegis-128x4 mac: [-73385-] {+74523+} MiB/s aegis-256x4 mac: [-30160-] {+30539+} MiB/s aegis-128x2 mac: [-66662-] {+67267+} MiB/s aegis-256x2 mac: [-16812-] {+16806+} MiB/s aegis-128l mac: [-33876-] {+34055+} MiB/s aegis-256 mac: [-8993-] {+9087+} MiB/s aes-cmac: 2036 MiB/s x25519: [-20670-] {+16844+} exchanges/s ed25519: [-29763-] {+29576+} signatures/s ecdsa-p256: [-4762-] {+4900+} signatures/s ecdsa-p384: [-1465-] {+1500+} signatures/s ecdsa-secp256k1: [-5643-] {+5769+} signatures/s ed25519: [-21926-] {+21721+} verifications/s ed25519: [-51200-] {+50880+} verifications/s (batch) chacha20Poly1305: [-1189-] {+1109+} MiB/s xchacha20Poly1305: [-1196-] {+1107+} MiB/s xchacha8Poly1305: [-1466-] {+1555+} MiB/s xsalsa20Poly1305: [-660-] {+620+} MiB/s aegis-128x4: [-76389-] {+78181+} MiB/s aegis-128x2: [-53946-] {+53495+} MiB/s aegis-128l: [-27219-] {+25621+} MiB/s aegis-256x4: [-49351-] {+49542+} MiB/s aegis-256x2: [-32390-] {+32366+} MiB/s aegis-256: [-8881-] {+8944+} MiB/s aes128-gcm: [-6095-] {+6205+} MiB/s aes256-gcm: [-5306-] {+5427+} MiB/s aes128-ocb: [-8529-] {+13974+} MiB/s aes256-ocb: [-7241-] {+9442+} MiB/s isapa128a: [-204-] {+214+} MiB/s aes128-single: [-133857882-] {+134170944+} ops/s aes256-single: [-96306962-] {+96408639+} ops/s aes128-8: [-1083210101-] {+1073727253+} ops/s aes256-8: [-762042466-] {+767091778+} ops/s bcrypt: 0.009 s/ops scrypt: [-0.018-] {+0.017+} s/ops argon2: [-0.037-] {+0.060+} s/ops kyber512d00: [-206057-] {+205779+} encaps/s kyber768d00: [-156074-] {+150711+} encaps/s kyber1024d00: [-116626-] {+115469+} encaps/s kyber512d00: [-181149-] {+182046+} decaps/s kyber768d00: [-136965-] {+135676+} decaps/s kyber1024d00: [-101307-] {+100643+} decaps/s kyber512d00: [-123624-] {+123375+} keygen/s kyber768d00: [-69465-] {+70828+} keygen/s kyber1024d00: [-43117-] {+43208+} keygen/s
2025-07-07std.io: deprecated Reader/Writer; introduce new APIAndrew Kelley
2025-02-17crypto.auth.Aegis128X*Mac: properly absorb tags in the first lane (#22922)Frank Denis
In the MAC finalization function, concatenated tags at odd positions were not absorbed into the correct lane. Spotted by a Tigerbeetle regression test and reported by Rafael Batiati (@batiati) — Thanks!
2024-12-11Reinstantiates AEGIS-MAC with the final construction (#22205)Frank Denis
This reverts commit c9d6f8b5058ba0df3bf281a3be3a3570c2219754.
2024-12-04Remove parallel variants of AEGIS-MAC (#22146)Frank Denis
The construction is likely to change before standardization
2024-11-22std.crypto.aes: introduce AES block vectors (#22023)Frank Denis
* std.crypto.aes: introduce AES block vectors Modern Intel CPUs with the VAES extension can handle more than a single AES block per instruction. So can some ARM and RISC-V CPUs. Software implementations with bitslicing can also greatly benefit from this. Implement low-level operations on AES block vectors, and the parallel AEGIS variants on top of them. AMD Zen4: aegis-128x4: 73225 MiB/s aegis-128x2: 51571 MiB/s aegis-128l: 25806 MiB/s aegis-256x4: 46742 MiB/s aegis-256x2: 30227 MiB/s aegis-256: 8436 MiB/s aes128-gcm: 5926 MiB/s aes256-gcm: 5085 MiB/s AES-GCM, and anything based on AES-CTR are also going to benefit from this later. * Make AEGIS-MAC twice a fast
2024-08-09std.crypto: better names for everything in utilsAndrew Kelley
std.crypto has quite a few instances of breaking naming conventions. This is the beginning of an effort to address that. Deprecates `std.crypto.utils`.
2024-03-12{aegis,aes_gcm}: fix overflow with large inputs on 32-bit systems (#19270)Frank Denis
These systems write the number of *bits* of their inputs as a u64. However if `@sizeOf(usize) == 4`, an input message or associated data whose size is > 512 MiB could overflow. On 64-bit systems, it is safe to assume that no machine has more than 2 EiB of memory.
2023-10-31std.builtin.Endian: make the tags lower caseAndrew Kelley
Let's take this breaking change opportunity to fix the style of this enum.
2023-10-31mem: fix ub in writeIntJacob Young
Use inline to vastly simplify the exposed API. This allows a comptime-known endian parameter to be propogated, making extra functions for a specific endianness completely unnecessary.
2023-10-23x86_64: implement 128-bit builtinsJacob Young
* `@clz` * `@ctz` * `@popCount` * `@byteSwap` * `@bitReverse` * various encodings used by std
2023-10-22Revert "Revert "Merge pull request #17637 from jacobly0/x86_64-test-std""Jacob Young
This reverts commit 6f0198cadbe29294f2bf3153a27beebd64377566.
2023-10-22Revert "Merge pull request #17637 from jacobly0/x86_64-test-std"Andrew Kelley
This reverts commit 0c99ba1eab63865592bb084feb271cd4e4b0357e, reversing changes made to 5f92b070bf284f1493b1b5d433dd3adde2f46727. This caused a CI failure when it landed in master branch due to a 128-bit `@byteSwap` in std.mem.
2023-10-21x86_64: fix bugs and disable erroring testsJacob Young
2023-08-14std.crypto.aead: Consistent decryption tail and doc fixes (#16781)e4m2
* Consistent decryption tail for all AEADs * Remove outdated note This was previously copied here from another function. There used to be another comment on the tag verification linking to issue #1776, but that one was not copied over. As it stands, this note seems fairly misleading/irrelevant. * Prettier docs * Add note about plaintext contents to docs * Capitalization * Fixup missing XChaChaPoly docs
2023-07-19Be more conservative in the description of Aegis256Mac (#16452)Frank Denis
It is assumed that generating a collision requires more than 2^156 ciphertext modifications. This is plenty enough for any practical purposes, but it hasn't been proven to be >= 2^256. Be consistent and conservative here; just claim the same security as the other variants.
2023-06-24all: migrate code to new cast builtin syntaxmlugg
Most of this migration was performed automatically with `zig fmt`. There were a few exceptions which I had to manually fix: * `@alignCast` and `@addrSpaceCast` cannot be automatically rewritten * `@truncate`'s fixup is incorrect for vectors * Test cases are not formatted, and their error locations change
2023-05-16crypto.AegisMac: fix a regression from s/mem.copy/@memcpy/ (#15733)Frank Denis
In an update whose size is not a multiple of the block size, we would end up calling @memcpy() with arguments of different sizes.
2023-04-28update codebase to use `@memset` and `@memcpy`Andrew Kelley
2023-04-25update `@memcpy` to require equal src and dest lensAndrew Kelley
* Sema: upgrade operands to array pointers if possible when emitting AIR. * Implement safety checks for length mismatch and aliasing. * AIR: make ptrtoint support slice operands. Implement in LLVM backend. * C backend: implement new `@memset` semantics. `@memcpy` is not done yet.
2023-04-21AEGIS MAC: add support for 128-bit tags (#15379)Frank Denis
When used as a MAC, 256-bit tags are recommended. But in interactive protocols, 128 bits may be acceptable.
2023-04-14std.crypto.aegis: support 256-bit tags (#15276)Frank Denis
2023-02-18update std lib and compiler sources to new for loop syntaxAndrew Kelley
2023-01-02std.crypto: make proper use of `undefined`Andrew Kelley
2022-11-22std.crypto.auth: add AEGIS MAC (#13607)Frank Denis
* Update the AEGIS specification URL to the current draft * std.crypto.auth: add AEGIS MAC The Pelican-based authentication function of the AEGIS construction can be used independently from authenticated encryption, as a faster and more secure alternative to GHASH/POLYVAL/Poly1305. We already expose GHASH, POLYVAL and Poly1305 for use outside AES-GCM and ChaChaPoly, so there are no reasons not to expose the MAC from AEGIS as well. Like other 128-bit hash functions, finding a collision only requires ~2^64 attempts or inputs, which may still be acceptable for many practical applications. Benchmark (Apple M1): siphash128-1-3: 3222 MiB/s ghash: 8682 MiB/s aegis-128l mac: 12544 MiB/s Benchmark (Zen 2): siphash128-1-3: 4732 MiB/s ghash: 5563 MiB/s aegis-128l mac: 19270 MiB/s
2021-08-24remove redundant license headers from zig standard libraryAndrew Kelley
We already have a LICENSE file that covers the Zig Standard Library. We no longer need to remind everyone that the license is MIT in every single file. Previously this was introduced to clarify the situation for a fork of Zig that made Zig's LICENSE file harder to find, and replaced it with their own license that required annual payments to their company. However that fork now appears to be dead. So there is no need to reinforce the copyright notice in every single file.
2021-05-20Run `zig fmt` on src/ and lib/std/Isaac Freund
This replaces callconv(.Inline) with the more idiomatic inline keyword.
2021-05-08std: update usage of std.testingVeikka Tuominen
2021-04-20std/crypto: use finer-grained error sets in function signatures (#8558)Frank Denis
std/crypto: use finer-grained error sets in function signatures Returning the `crypto.Error` error set for all crypto operations was very convenient to ensure that errors were used consistently, and to avoid having multiple error names for the same thing. The flipside is that callers were forced to always handle all possible errors, even those that could never be returned by a function. This PR makes all functions return union sets of the actual errors they can return. The error sets themselves are all limited to a single error. Larger sets are useful for platform-specific APIs, but we don't have any of these in `std/crypto`, and I couldn't find any meaningful way to build larger sets.
2021-03-14Use a unified error set for std/crypto/*Frank Denis
This ensures that errors are used consistently across all operations.
2021-02-24zig fmt the std libAndrew Kelley
2021-02-10Convert inline fn to callconv(.Inline) everywhereTadeo Kondrak
2020-12-31Year++Frank Denis
2020-10-26std/*: add missing MIT license headersFrank Denis
2020-10-17std/crypto: make the whole APIs more consistentFrank Denis
- use `PascalCase` for all types. So, AES256GCM is now Aes256Gcm. - consistently use `_length` instead of mixing `_size` and `_length` for the constants we expose - Use `minimum_key_length` when it represents an actual minimum length. Otherwise, use `key_length`. - Require output buffers (for ciphertexts, macs, hashes) to be of the right size, not at least of that size in some functions, and the exact size elsewhere. - Use a `_bits` suffix instead of `_length` when a size is represented as a number of bits to avoid confusion. - Functions returning a constant-sized slice are now defined as a slice instead of a pointer + a runtime assertion. This is the case for most hash functions. - Use `camelCase` for all functions instead of `snake_case`. No functional changes, but these are breaking API changes.
2020-09-29aegis: add test vectors, and link to the latest version of the specFrank Denis
2020-09-29Add AEGIS-256 as wellFrank Denis
2020-09-29std/crypto: add the AEGIS128L AEADFrank Denis
Showcase that Zig can be a great option for high performance cryptography. The AEGIS family of authenticated encryption algorithms was selected for high-performance applications in the final portfolio of the CAESAR competition. They reuse the AES core function, but are substantially faster than the CCM, GCM and OCB modes while offering a high level of security. AEGIS algorithms are especially fast on CPUs with built-in AES support, and the 128L variant fully takes advantage of the pipeline in modern Intel CPUs. Performance of the Zig implementation is on par with libsodium.
generated by cgit v1.2.3 (git 2.39.1) at 2025-12-29 00:04:26 +0000