blake2b gives a wrong value on powerpc-unknown-linux-gnu

[linkmauve]

In xmpp-rs, we have a test which started to fail on this platform after bumping the RustCrypto crates to 0.10:

---- ecaps2::tests::test_blake2b_512 stdout ----
thread 'main' panicked at 'assertion failed: `(left == right)`
  left: `[107, 235, 164, 173, 234, 235, 170, 225, 55, 10, 138, 151, 244, 209, 149, 32, 75, 79, 184, 110, 158, 195, 195, 113, 25, 50, 170, 193, 54, 212, 114, 249, 126, 45, 33, 153, 72, 91, 165, 232, 190, 247, 148, 234, 206, 56, 34, 151, 206, 131, 216, 50, 100, 195, 84, 131,
143, 218, 125, 57, 112, 138, 100, 98]`,
 right: `[186, 128, 165, 63, 152, 28, 77, 13, 106, 39, 151, 182, 159, 18, 246, 233, 76, 33, 47, 20, 104, 90, 196, 183, 75, 18, 187, 111, 219, 255, 162, 209, 125, 135, 197, 57, 42, 171, 121, 45, 194, 82, 213, 222, 69, 51, 204, 149, 24, 211, 138, 168, 219, 241, 146, 90, 185,
35, 134, 237, 212, 0, 153, 35]`', parsers/src/ecaps2.rs:479:9
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace

The same test runs fine on amd64, as can be seen in our CI.

[tarcieri]

It seems we don't cross-test blake2b like we do other crates like sha2 and sha3, so it seems possible there might be an endianness-related (or other) bug

[linkmauve]

I tested on armv7-unknown-linux-gnueabihf as well, as an architecture which is 32-bit, it returns the correct result, so the issue really seems to be big endian.

[newpavlov]

Have you tried implementation from the blake2b_simd/blake2s_simd crates? We plan to eventually migrate the current implementation of blake2 to one based on them.

[linkmauve]

Thanks, I wasn’t aware of these crates!

I just replaced blake2 with blake2b_simd in xmpp-parsers and tested that it still produces the same values on both amd64 and powerpc. Once that migration is complete, you can close this issue! Alternatively, consider this my Tested-by: for the migration. :)

[newpavlov]

@linkmauve
BTW are you using any non-default blake2 features? After a cursory look I couldn't find a potential source of the bug in the software backend.

[linkmauve]

No, we are using it without any feature besides the default ones.

[decathorpe]

I can provide another data point: I'm working on updating the RPM packages for RustCrypto crates in Fedora Linux, and I hit the same problem with blake2. The test suite of blake2 version 0.9.2 passes on every architecture we have, but version 0.10.3 looks very broken on s390x / System Z (the only big-endian architecture we have). We run cargo test with --no-fail-fast, so this should be the complete list of failing tests:

     Running `/builddir/build/BUILD/blake2-0.10.3/target/release/deps/blake2-25da749af72b2217`
running 0 tests
test result: ok. 0 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
     Running `/builddir/build/BUILD/blake2-0.10.3/target/release/deps/mac-6ff1ee13e62bbbbb`
running 2 tests
test blake2s_mac ... FAILED
test blake2b_mac ... FAILED
failures:
---- blake2s_mac stdout ----
thread 'blake2s_mac' panicked at '
Failed test â„–0: whole message
key:	[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31]
input:	[]
tag:	[72, 168, 153, 125, 164, 7, 135, 107, 61, 121, 192, 217, 35, 37, 173, 59, 137, 203, 183, 84, 216, 106, 183, 26, 238, 4, 122, 211, 69, 253, 44, 73]
', tests/mac.rs:7:1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
---- blake2b_mac stdout ----
thread 'blake2b_mac' panicked at '
Failed test â„–0: whole message
key:	[0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28, 29, 30, 31, 32, 33, 34, 35, 36, 37, 38, 39, 40, 41, 42, 43, 44, 45, 46, 47, 48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 58, 59, 60, 61, 62, 63]
input:	[]
tag:	[16, 235, 182, 119, 0, 177, 134, 142, 251, 68, 23, 152, 122, 207, 70, 144, 174, 157, 151, 47, 183, 165, 144, 194, 240, 40, 113, 121, 154, 170, 71, 134, 181, 233, 150, 232, 240, 244, 235, 152, 31, 194, 20, 176, 5, 244, 45, 47, 244, 35, 52, 153, 57, 22, 83, 223, 122, 239, 203, 193, 63, 197, 21, 104]
', tests/mac.rs:6:1
failures:
    blake2b_mac
    blake2s_mac
test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
     Running `/builddir/build/BUILD/blake2-0.10.3/target/release/deps/mod-b906a93486295987`
running 3 tests
test blake2b_variable ... ok
test blake2b_fixed ... FAILED
test blake2s_variable ... FAILED
failures:
---- blake2b_fixed stdout ----
thread 'blake2b_fixed' panicked at '
Failed test â„–1: whole message
input:	[84, 104, 101, 32, 113, 117, 105, 99, 107, 32, 98, 114, 111, 119, 110, 32, 102, 111, 120, 32, 106, 117, 109, 112, 115, 32, 111, 118, 101, 114, 32, 116, 104, 101, 32, 108, 97, 122, 121, 32, 100, 111, 103]
output:	[168, 173, 212, 189, 221, 253, 147, 228, 135, 125, 39, 70, 230, 40, 23, 177, 22, 54, 74, 31, 167, 188, 20, 141, 149, 9, 11, 199, 51, 59, 54, 115, 248, 36, 1, 207, 122, 162, 228, 203, 30, 205, 144, 41, 110, 63, 20, 203, 84, 19, 248, 237, 119, 190, 115, 4, 91, 19, 145, 76, 220, 214, 169, 24]
', tests/mod.rs:7:1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
---- blake2s_variable stdout ----
thread 'blake2s_variable' panicked at '
Failed test â„–0: whole message
input:	[97, 98, 115, 100, 101, 102, 103, 104, 102, 111, 111, 98, 97, 114]
output:	[32, 56, 202, 167, 168, 7, 219, 242, 89, 61, 231, 204, 38, 50, 125, 66, 18]
', tests/mod.rs:14:1
failures:
    blake2b_fixed
    blake2s_variable
test result: FAILED. 1 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
     Running `/builddir/build/BUILD/blake2-0.10.3/target/release/deps/persona-1aa388e8e6bf0500`
running 2 tests
test blake2s_persona ... FAILED
test blake2b_persona ... FAILED
failures:
---- blake2s_persona stdout ----
thread 'blake2s_persona' panicked at 'assertion failed: `(left == right)`
  left: `[105, 246, 46, 177, 233, 148, 45, 192, 233, 40, 171, 138, 124, 103, 161, 182, 4, 228, 135, 248, 29, 40, 131, 248, 242, 247, 17, 173, 231, 57, 118, 76]`,
 right: `[37, 164, 238, 99, 181, 148, 174, 211, 248, 138, 151, 30, 24, 119, 239, 112, 153, 83, 79, 144, 151, 41, 31, 136, 251, 134, 199, 155, 94, 112, 208, 34]`', tests/persona.rs:13:5
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
---- blake2b_persona stdout ----
thread 'blake2b_persona' panicked at 'assertion failed: `(left == right)`
  left: `[82, 242, 66, 186, 106, 74, 82, 231, 52, 187, 53, 193, 123, 110, 60, 205, 97, 37, 203, 133, 170, 157, 64, 62, 245, 94, 184, 147, 4, 243, 128, 34, 62, 38, 186, 204, 78, 226, 233, 44, 126, 162, 138, 25, 225, 151, 59, 153, 194, 252, 57, 129, 108, 227, 193, 96, 125, 128, 224, 140, 73, 35, 74, 192]`,
 right: `[3, 222, 59, 41, 93, 207, 195, 178, 91, 5, 171, 176, 155, 201, 95, 227, 233, 255, 48, 115, 99, 139, 173, 198, 129, 1, 209, 228, 32, 25, 208, 119, 29, 208, 117, 37, 163, 170, 232, 49, 142, 146, 197, 229, 217, 103, 186, 146, 228, 129, 13, 0, 33, 215, 191, 59, 73, 218, 11, 75, 74, 138, 78, 31]`', tests/persona.rs:31:5
failures:
    blake2b_persona
    blake2s_persona
test result: FAILED. 0 passed; 2 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.00s
   Doc-tests blake2
     Running `/usr/bin/rustdoc --edition=2018 --crate-type lib --crate-name blake2 --test /builddir/build/BUILD/blake2-0.10.3/src/lib.rs -L dependency=/builddir/build/BUILD/blake2-0.10.3/target/release/deps -L dependency=/builddir/build/BUILD/blake2-0.10.3/target/release/deps --extern blake2=/builddir/build/BUILD/blake2-0.10.3/target/release/deps/libblake2-161ec07ece51ba69.rlib --extern digest=/builddir/build/BUILD/blake2-0.10.3/target/release/deps/libdigest-22a0ba5da31423eb.rlib --extern hex_literal=/builddir/build/BUILD/blake2-0.10.3/target/release/deps/libhex_literal-45c8a7849e631243.rlib -C embed-bitcode=no --cfg 'feature="default"' --cfg 'feature="std"' --error-format human`
running 3 tests
test src/lib.rs - (line 40) ... FAILED
test src/lib.rs - (line 53) ... FAILED
test src/lib.rs - (line 7) ... FAILED
failures:
---- src/lib.rs - (line 40) stdout ----
Test executable failed (exit code 101).
stderr:
thread 'main' panicked at 'assertion failed: `(left == right)`
  left: `[140, 237, 22, 10, 195, 148, 72, 38, 255, 187]`,
 right: `[44, 197, 92, 132, 228, 22, 146, 78, 100, 0]`', src/lib.rs:12:1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
---- src/lib.rs - (line 53) stdout ----
Test executable failed (exit code 101).
stderr:
thread 'main' panicked at 'assertion failed: `(left == right)`
  left: `[140, 237, 22, 10, 195, 148, 72, 38, 255, 187]`,
 right: `[44, 197, 92, 132, 228, 22, 146, 78, 100, 0]`', src/lib.rs:12:1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
---- src/lib.rs - (line 7) stdout ----
Test executable failed (exit code 101).
stderr:
thread 'main' panicked at 'assertion failed: `(left == right)`
  left: `[234, 3, 56, 6, 133, 78, 222, 161, 21, 16, 185, 54, 90, 102, 67, 55, 79, 158, 113, 215, 87, 108, 132, 206, 140, 185, 24, 212, 148, 175, 180, 148, 1, 57, 92, 63, 103, 92, 128, 159, 205, 232, 234, 26, 149, 65, 155, 150, 48, 26, 6, 238, 222, 224, 47, 136, 149, 110, 200, 74, 28, 81, 168, 123]`,
 right: `[2, 28, 237, 135, 153, 41, 108, 236, 165, 87, 131, 42, 185, 65, 165, 11, 74, 17, 248, 52, 120, 207, 20, 31, 81, 249, 51, 246, 83, 171, 159, 188, 192, 90, 3, 124, 221, 190, 208, 110, 48, 155, 243, 52, 148, 44, 78, 88, 205, 241, 164, 110, 35, 121, 17, 204, 215, 252, 249, 120, 124, 188, 127, 208]`', src/lib.rs:15:1
note: run with `RUST_BACKTRACE=1` environment variable to display a backtrace
failures:
    src/lib.rs - (line 40)
    src/lib.rs - (line 53)
    src/lib.rs - (line 7)
test result: FAILED. 0 passed; 3 failed; 0 ignored; 0 measured; 0 filtered out; finished in 0.46s
error: test failed, to rerun pass '--doc'

[aewag]

@linkmauve @decathorpe The endianness issue seems to be fixed with #366.

cc @tarcieri @newpavlov I'll added a cross job for the future.

[linkmauve]

Ah, you’ve been faster than my Wii U, I just tested on it and it does fix this issue for me, thanks!