mutants-2.patch (2666B)
1 From ab7f9911e3a1817a887adfb43a4bc020fe849c4c Mon Sep 17 00:00:00 2001 2 From: Jared Tobin <jared@jtobin.io> 3 Date: Tue, 6 Oct 2026 12:18:02 +0400 4 Subject: [PATCH] exp: compiler-level timing mutants for elenchus baselines 5 6 --- 7 lib/Crypto/MAC/Poly1305.hs | 24 ++++++++++++++---------- 8 1 file changed, 14 insertions(+), 10 deletions(-) 9 10 diff --git a/lib/Crypto/MAC/Poly1305.hs b/lib/Crypto/MAC/Poly1305.hs 11 index fb0c261..fed41ad 100644 12 --- a/lib/Crypto/MAC/Poly1305.hs 13 +++ b/lib/Crypto/MAC/Poly1305.hs 14 @@ -27,8 +27,8 @@ module Crypto.MAC.Poly1305 ( 15 ) where 16 17 import qualified Crypto.MAC.Poly1305.Arm as Arm 18 -import Data.Barrier (barrier) 19 import qualified Data.Bits as B 20 +import qualified Data.Choice as C 21 import qualified Data.ByteString as BS 22 import qualified Data.ByteString.Internal as BI 23 import qualified Data.ByteString.Unsafe as BU 24 @@ -161,13 +161,10 @@ instance Eq MAC where 25 -- fused fold: OR the bytewise XORs into an accumulator 26 -- directly, rather than via packZipWith, so no intermediate 27 -- ByteString holding the (secret-derived) difference bytes 28 - -- is ever materialised on the heap. The accumulator is routed 29 - -- through 'barrier' before the zero-test so the LLVM backend 30 - -- cannot recover the array-equality idiom and short-circuit on 31 - -- the first mismatch (see "Data.Barrier"). 32 + -- is ever materialised on the heap. 33 go :: Word8 -> Int -> Bool 34 go !acc !i 35 - | i == la = barrier acc == 0 36 + | i == la = acc == 0 37 | otherwise = 38 let !x = BU.unsafeIndex a i 39 !y = BU.unsafeIndex b i 40 @@ -206,8 +203,10 @@ mask130 = 0x3ffffffffffffffffffffffffffffffff 41 reduce_partial :: Wider -> Wider 42 reduce_partial x = 43 let !lo = x `W.and` mask130 44 - !hi = shr130 x 45 - in lo + 5 * hi 46 + !hi@(Wider (# Limb h0, Limb h1, _, _ #)) = shr130 x 47 + in if Exts.isTrue# (Exts.eqWord# (Exts.or# h0 h1) 0##) 48 + then lo 49 + else lo + 5 * hi 50 {-# INLINE reduce_partial #-} 51 52 -- [0, 2 ^ 131) -> [0, p) 53 @@ -218,11 +217,16 @@ reduce_full h = 54 !h' = lo + 5 * hi 55 !h_5 = h' + 5 56 !reduced = h_5 `W.and` mask130 57 - !carry = shr130 h_5 58 - !gte = W.lt 0 carry 59 + !(Wider (# Limb c, _, _, _ #)) = shr130 h_5 60 + !gte = C.from_bit# (bit (Exts.isTrue# (Exts.neWord# c 0##))) 61 in W.select h' reduced gte 62 {-# INLINE reduce_full #-} 63 64 +-- 1 for True, 0 for False 65 +bit :: Bool -> Exts.Word# 66 +bit b = if b then 1## else 0## 67 +{-# INLINE bit #-} 68 + 69 _poly1305_loop :: Wider -> Wider -> BS.ByteString -> BS.ByteString 70 _poly1305_loop !r !s !msg = 71 let loop !acc !bs = case BS.splitAt 16 bs of 72 -- 73 2.55.0 74