mirror of
https://github.com/borgbackup/borg.git
synced 2026-10-12 02:11:36 +00:00
Thomas WaldmannandClaude Fable 5
b7dcf30bd4
Add a "UHF-then-PRF" content-defined chunker following the Chk-PHTE construction of "Breaking and Fixing Content-Defined Chunking" (Truong et al., eprint 2025/558): a rolling Rabin fingerprint over GF(2)[x]/P(x) - with P a secret, random, irreducible polynomial of degree 63 - hashes the last 64 bytes (a universal hash family), and AES-128 with a secret key is applied to the digest; the cut decision only looks at the AES output. Observed chunk boundaries are thus pseudo-random and yield no usable equations about the chunking secrets, unlike chunkers cutting directly on (keyed) rolling-hash bits. Both secrets are derived from the id key (domain "rabin-aes"). The C scan kernel has three bit-identical paths: batched OpenSSL EVP AES-128-ECB (portable), arm64 crypto-extension intrinsics and x86-64 AES-NI (runtime detected), interleaving the AES work with the serial rolling-hash chain. Batching ahead of the cut decision is possible because the digest stream does not depend on where cuts happen. Throughput on an Apple M-series (1 GiB random, 19,23,21,2): 489 MB/s (arm64 hw path), 334 MB/s (EVP path); chunk-size distribution, shift resilience and dedup behavior are identical to fastcdc/buzhash64. Normalized chunking, param shape rabin-aes,min,max,mask,nc_level. Co-Authored-By: Claude Fable 5 <[email protected]>