Description

picnixz

opened on Aug 24, 2025

Issue body actions

Bug report

Bug description:

First of all, it doesn't really make sense to support HMAC-BLAKE-2 because BLAKE-2 is already a keyed hash function so it already has the properties expected by HMAC. Since HACL* provides it (I don't remember if I actually asked them to, so if I did, it's my fault), I decided to expose it anyway.

HACL* provides SIMD-accelerated implementation for BLAKE-2 which is exposed if the HACL_CAN_COMPILE_VEC128 and HACL_CAN_COMPILE_VEC256 macros are defined. CPython, however, needs to do a bit more work to be able to know whether we can define those macros or not. The work is achieved in two steps:

• In configure, depending on the host capabilities, the macros are defined.
• When compiling, depending on the host capabilities once again, the macros are undefined.

The generic headers are afterwards included, e.g.:

#define HACL_CAN_COMPILE_VEC128 _Py_HACL_CAN_COMPILE_VEC128
#define HACL_CAN_COMPILE_VEC256 _Py_HACL_CAN_COMPILE_VEC256

#include "_hacl/Hacl_HMAC.h"
#include "_hacl/Hacl_Streaming_HMAC.h"  // Hacl_Agile_Hash_* identifiers
#include "_hacl/Hacl_Streaming_Types.h" // Hacl_Streaming_Types_error_code

Now, there is a slight issue. The conditional code is actually inside the .c file and not the .h. However, that .c file is an HACL* file that is compiled separately and doesn't have any defines. It also unconditionally includes Hacl_Hash_Blake2s_Simd128.h and Hacl_Hash_Blake2s_Simd256.h files. So I'm not entirely sure about what to do :(

Am I incorrectly using the files @msprotz?

CPython versions tested on:

CPython main branch, 3.14, 3.15

Operating systems tested on:

No response

Linked PRs

• gh-138114: Enable HACL BLAKE2 SIMD128 vectorization on PowerPC64 #146118

Activity

1. picnixz

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   extension-modulesC modules in the Modules dirC modules in the Modules dir

   buildThe build process and cross-buildThe build process and cross-build

   on Aug 24, 2025
2. msprotz commented on Aug 25, 2025

   

   msprotz

   on Aug 25, 2025

   Contributor

   More actions

   First of all, it doesn't really make sense to support HMAC-BLAKE-2 because BLAKE-2 is already a keyed hash function so it already has the properties expected by HMAC.

   I seem to remember this was an odd construction expected by Signal (or maybe Noise?). This is why we ended up adding it.

   I can't tell from your bug report what the actual problem is (sorry! I probably need more coffee), but here's what I remember about the design and how we fixed it all:

   • Hacl_Streaming_HMAC.c can always be compiled, regardless of whether the host supports emitting SIMD instructions or not, and this works because
     1. Hacl_Hash_Blake2s_Simd128.h is a well-abstracted header that relies on the "incomplete struct type" pattern to not reveal anything about the nature of Hacl_Hash_Blake2s_Simd128_block_state_t, and as such, can always be compiled (even if the host does not support emitting SIMD instructions)
     2. The usage of SIMD stuff in Hacl_Streaming_HMAC.c is enabled (using ifdefs) only if the host supports emitting SIMD
     3. The vector types in the typedef in internal/Hacl_Streaming_HMAC.h (namely, Lib_IntVector_Intrinsics_vec128) are using a hack to work around limitations in older compilers (see libintvector-shim.h and the lengthy comment there)
   • Hacl_Hash_Blake2s_Simd128.c can only be compiled if your compiler does support emitting SIMD instructions -- the build will only pick up this file if this is the case (meaning that there are references from Hacl_Streaming_HMAC.c to Hacl_Hash_Blake2s_Simd128.c) -- symmetrically, if your compiler does not support emitting SIMD, Hacl_Streaming_HMAC.c contains no such references (because of the ifdefs), meaning that Hacl_Hash_Blake2s_Simd128.c can be safely omitted from the build.

   Does this help? Let me know where the reality doesn't match my description above and I can help dig in. Thanks!
3. Scottcjn

   added a commit that references this issue on Mar 18, 2026

   pythongh-138114: Enable HACL BLAKE2 SIMD128 vectorization on PowerPC64

   db4bdde

Issue actions