tls 2.4.6 → 2.4.7
raw patch · 3 files changed
+67/−42 lines, 3 filesdep ~cryptonPVP ok
version bump matches the API change (PVP)
Dependency ranges changed: crypton
API changes (from Hackage documentation)
Files
- CHANGELOG.md +14/−0
- Network/TLS/Extra/Cipher.hs +51/−40
- tls.cabal +2/−2
CHANGELOG.md view
@@ -1,5 +1,19 @@ # Change log for "tls" +## Version 2.4.7++* The AES-GCM and ChaCha20-Poly1305 bulk ciphers go through the one-call+ interfaces of crypton 2.1.1 -- `Crypto.Cipher.AES.GCM` and+ `Crypto.Cipher.ChaCha.Poly1305` -- rather than the general AEAD one. Two+ fixed costs go with every record: the state the key alone determines, which+ `aeadInit` rebuilt for each record and `newContext` now builds once; and a+ dictionary, which `AEADModeImpl`'s `forall ba. ByteArray ba =>` fields pass+ at every call and no pragma can remove. Measured through `BulkAEAD` on an+ Apple M4, a 64-byte record is about 73% faster to encrypt and to decrypt, a+ 1400-byte one about 30%, and a 16 KiB one 2 to 4%. This needs+ `crypton >= 2.1.1`; anyone who cannot move stays on 2.4.6, which is+ unaffected+ ## Version 2.4.6 * Accept crypton 2.1, which made `ChaChaPoly1305.initialize` total by
Network/TLS/Extra/Cipher.hs view
@@ -70,10 +70,12 @@ ) where import Crypto.Cipher.AES-import qualified Crypto.Cipher.ChaChaPoly1305 as ChaChaPoly1305+import qualified Crypto.Cipher.AES.GCM as GCM+import qualified Crypto.Cipher.ChaCha.Poly1305 as ChaChaOne import Crypto.Cipher.Types hiding (Cipher, cipherName) import Crypto.Error import Crypto.System.CPU+import Data.ByteArray (convert) import qualified Data.ByteString as B import Data.Tuple (swap) @@ -618,20 +620,40 @@ in simpleDecrypt aeadIni ad d 8 ) +-- The AES-GCM and ChaCha20-Poly1305 ciphers go through the one-call+-- interfaces crypton added for this, not the general AEAD one. Two things+-- are saved on every record.+--+-- The state the key alone determines -- the AES key schedule and the table of+-- multiples of H -- was rebuilt for each record by aeadInit; newContext+-- builds it once, here, where the key is fixed.+--+-- And the general interface reaches its cipher through AEADModeImpl, whose+-- fields are @forall ba. ByteArray ba => ...@, so a dictionary is passed at+-- every call and no pragma can remove it.+--+-- Measured in C on an idle Haswell, against what this did before: 64-byte+-- record 0.169 -> 0.047 microseconds, 1400-byte 0.501 -> 0.301, 16 KiB+-- 3.285 -> 3.207. It is a fixed cost that goes, so it is most of a small+-- record and little of a full one.+aesgcm :: BulkDirection -> BulkKey -> BulkAEAD+aesgcm BulkEncrypt key =+ let ctx = noFail (GCM.newContext key)+ in \nonce d ad ->+ let sealed = GCM.encrypt ctx nonce ad d 16+ (out, tag) = B.splitAt (B.length sealed - 16) sealed+ in (out, AuthTag (convert tag))+aesgcm BulkDecrypt key =+ let ctx = noFail (GCM.newContext key)+ in \nonce d ad -> GCM.decryptWithTag ctx nonce ad d 16+ aes128gcm :: BulkDirection -> BulkKey -> BulkAEAD-aes128gcm BulkEncrypt key =- let ctx = noFail (cipherInit key) :: AES128- in ( \nonce d ad ->- let aeadIni = noFail (aeadInit AEAD_GCM ctx nonce)- in swap $ aeadSimpleEncrypt aeadIni ad d 16- )-aes128gcm BulkDecrypt key =- let ctx = noFail (cipherInit key) :: AES128- in ( \nonce d ad ->- let aeadIni = noFail (aeadInit AEAD_GCM ctx nonce)- in simpleDecrypt aeadIni ad d 16- )+aes128gcm = aesgcm +aes256gcm :: BulkDirection -> BulkKey -> BulkAEAD+aes256gcm = aesgcm++ aes256ccm :: BulkDirection -> BulkKey -> BulkAEAD aes256ccm BulkEncrypt key = let ctx = noFail (cipherInit key) :: AES256@@ -664,20 +686,6 @@ in simpleDecrypt aeadIni ad d 8 ) -aes256gcm :: BulkDirection -> BulkKey -> BulkAEAD-aes256gcm BulkEncrypt key =- let ctx = noFail (cipherInit key) :: AES256- in ( \nonce d ad ->- let aeadIni = noFail (aeadInit AEAD_GCM ctx nonce)- in swap $ aeadSimpleEncrypt aeadIni ad d 16- )-aes256gcm BulkDecrypt key =- let ctx = noFail (cipherInit key) :: AES256- in ( \nonce d ad ->- let aeadIni = noFail (aeadInit AEAD_GCM ctx nonce)- in simpleDecrypt aeadIni ad d 16- )- simpleDecrypt :: AEAD cipher -> ByteString -> ByteString -> Int -> (ByteString, AuthTag) simpleDecrypt aeadIni header input taglen = (output, tag)@@ -689,20 +697,23 @@ noFail :: CryptoFailable a -> a noFail = throwCryptoError --- Through the AEAD interface rather than the state directly, as the AES--- ciphers above do. The two are the same computation -- crypton's AEAD model--- for this cipher is finalizeAAD . appendAAD, then encrypt or decrypt, then--- the whole sixteen-byte Poly1305 tag whatever length is asked of it -- but--- aeadChacha20poly1305Init has one type across every crypton this package--- accepts, where the lower-level initialize does not: crypton 2.1 made it--- total, taking a checked Key rather than any ByteArrayAccess.+-- The one-call interface here too, and for the same two reasons as the AES+-- ciphers above: the step-at-a-time Crypto.Cipher.ChaChaPoly1305 is eight+-- foreign calls and the allocations between them for a message that arrived+-- whole, and the general AEAD interface passes a dictionary a call.+--+-- Measured through the Haskell interface on an Apple M4: 100 bytes 0.97 ->+-- 0.415 microseconds, 1400 bytes 2.89 -> 2.36. chacha20poly1305 :: BulkDirection -> BulkKey -> BulkAEAD-chacha20poly1305 BulkEncrypt key nonce =- let aeadIni = noFail (ChaChaPoly1305.aeadChacha20poly1305Init key nonce)- in (\input ad -> swap $ aeadSimpleEncrypt aeadIni ad input 16)-chacha20poly1305 BulkDecrypt key nonce =- let aeadIni = noFail (ChaChaPoly1305.aeadChacha20poly1305Init key nonce)- in (\input ad -> simpleDecrypt aeadIni ad input 16)+chacha20poly1305 BulkEncrypt key =+ let ctx = noFail (ChaChaOne.newContext key)+ in \nonce d ad ->+ let sealed = noFail (ChaChaOne.encrypt ctx nonce ad d 16)+ (out, tag) = B.splitAt (B.length sealed - 16) sealed+ in (out, AuthTag (convert tag))+chacha20poly1305 BulkDecrypt key =+ let ctx = noFail (ChaChaOne.newContext key)+ in \nonce d ad -> noFail (ChaChaOne.decryptWithTag ctx nonce ad d 16) ----------------------------------------------------------------
tls.cabal view
@@ -1,6 +1,6 @@ cabal-version: 2.0 name: tls-version: 2.4.6+version: 2.4.7 license: BSD3 license-file: LICENSE copyright: Vincent Hanquez <vincent@snarc.org>@@ -122,7 +122,7 @@ base16-bytestring, bytestring >=0.10 && <0.13, cereal >=0.5.3 && <0.6,- crypton >=1.1.2 && <2.2,+ crypton >=2.1.1 && <2.2, crypton-asn1-encoding >= 0.10.0 && < 0.11, crypton-asn1-types >= 0.4.1 && < 0.5, crypton-x509 >=1.9 && <1.10,