Use crypto/sha256

[KN4CK3R]

Go 1.21 improved the performance of crypto/sha256. It's now similar to minio/sha256-simd, so we should just use the standard libs.

https://go.dev/doc/go1.21#crypto/sha256
https://go-review.googlesource.com/c/go/+/408795
multiformats/go-multihash#173

[lunny]

but the improvement is only for amd64?

[wxiaoguang]

IIRC it lacks arm64 optimization.

[lunny]

#29386 (comment)

[silverwind]

I would still use stdlib over a dependency even if it means slightly worse perf on the other archs as those are bound to eventually improve on other archs. amd64 likely accounts for 95%+ of installations. Also, is sha256 really a bottleneck for gitea?

[wxiaoguang]

I didn't mean objection or blocker (I could be neutral for it). Yes, sha256 is not a bottleneck for gitea, but I just didn't find a reason worth to do so:

1. Does the stdlib improve performance? No, and maybe it degrades for arm64 instances.
2. Does the stdlib improve maintainability? IMO no because the minio version is a 100% drop-in replacement, it could be easily replaced at any time.
3. Does it drop the minio dependency or decrease binary side? No, because as long as minio package still uses their sha256 package, the code is still there ....

So, I just didn't know whether it is worth to use stdlib to replace minio version.

[KN4CK3R]

Comparing https://github.com/minio/sha256-simd/blob/master/sha256block_arm64.s with https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/crypto/sha256/sha256block_arm64.s they use the same intrinsics so they could have similar performance. Does someone have an arm64 machine and could do a benchmark?

[wxiaoguang]

Comparing https://github.com/minio/sha256-simd/blob/master/sha256block_arm64.s with https://cs.opensource.google/go/go/+/refs/tags/go1.22.0:src/crypto/sha256/sha256block_arm64.s they use the same intrinsics so they could have similar performance. Does someone have an arm64 machine and could do a benchmark?

Is it a new enhancement in Go 1.22? In Go 1.21, they only mentions "amd64".

If the stdlib also have the same performance, then I don't have any question.

dismiss

[silverwind]

I would prefer stdlib because it will likely be better maintained long-term and they also have better processes in place for security issues and such.

[KN4CK3R]

Is it a new enhancement in Go 1.22? In Go 1.21, they only mentions "amd64".

No, minio announced 2016 their improved ARM64 support. A year later hardware support for ARM64 was added to Go too (https://cs.opensource.google/go/go/+/7b8a7f8272fd1941a199af1adb334bd9996e8909) So both should have similar performance since Go 1.10 (?) With Go 1.21 they just added support for sha-ni for x64 cpus.