• Jason A. Donenfeld's avatar
    secure_seq: use SipHash in place of MD5 · 7cd23e53
    Jason A. Donenfeld authored
    This gives a clear speed and security improvement. Siphash is both
    faster and is more solid crypto than the aging MD5.
    
    Rather than manually filling MD5 buffers, for IPv6, we simply create
    a layout by a simple anonymous struct, for which gcc generates
    rather efficient code. For IPv4, we pass the values directly to the
    short input convenience functions.
    
    64-bit x86_64:
    [    1.683628] secure_tcpv6_sequence_number_md5# cycles: 99563527
    [    1.717350] secure_tcp_sequence_number_md5# cycles: 92890502
    [    1.741968] secure_tcpv6_sequence_number_siphash# cycles: 67825362
    [    1.762048] secure_tcp_sequence_number_siphash# cycles: 67485526
    
    32-bit x86:
    [    1.600012] secure_tcpv6_sequence_number_md5# cycles: 103227892
    [    1.634219] secure_tcp_sequence_number_md5# cycles: 94732544
    [    1.669102] secure_tcpv6_sequence_number_siphash# cycles: 96299384
    [    1.700165] secure_tcp_sequence_number_siphash# cycles: 86015473
    Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
    Cc: Andi Kleen <ak@linux.intel.com>
    Cc: David Miller <davem@davemloft.net>
    Cc: David Laight <David.Laight@aculab.com>
    Cc: Tom Herbert <tom@herbertland.com>
    Cc: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Cc: Eric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    7cd23e53
secure_seq.c 4.14 KB