4 ms·
Math and crypto code are different from business logic. Under some circumstances, it's acceptable to use single-letter variable names. This often happens when t
by segfaultbuserr 4y ago
Math and crypto code are different from business logic. Under some circumstances, it's acceptable to use single-letter variable names. This often happens when the code implements a mathematical operation according to a standard formula.
For example, the following SHA-256 code comes from OpenBSD - a Unix derivative known for its focus on security and correctness.
do {
/* Rounds 0 to 15 (unrolled): */
ROUND256_0_TO_15(a,b,c,d,e,f,g,h);
ROUND256_0_TO_15(h,a,b,c,d,e,f,g);
ROUND256_0_TO_15(g,h,a,b,c,d,e,f);
ROUND256_0_TO_15(f,g,h,a,b,c,d,e);
ROUND256_0_TO_15(e,f,g,h,a,b,c,d);
ROUND256_0_TO_15(d,e,f,g,h,a,b,c);
ROUND256_0_TO_15(c,d,e,f,g,h,a,b);
ROUND256_0_TO_15(b,c,d,e,f,g,h,a);
} while (j < 16);
In this particular case, the code is a direct translation of math, following the paper's notations is preferable. The state variables are named a, b, c, d, e, f, g because they're what the authors of SHA-256 chose to call them. When writing this particular fragment of code, renaming the state variables to something else is not constructive and increases the chance of mistakes.
I haven't read the OpenSSL code in question so I cannot comment whether the uses of single-letter variables in your comment are appropriate. To make an educated guess, a, b, m, r are probably reasonable. The uses of carry, mask, num, tmp are potentially questionable, though.