Support for micro benchmarks with [Google Benchmark](https://github.c…

…om/google/benchmark). Additionally, add HMAC BoringSSL Microbenchmarks.

PiperOrigin-RevId: 720686314
Change-Id: Ica2aa8ea96acec5561bded150ee42833c204deb6

MODULE.bazel

@@ -59,6 +59,13 @@ bazel_dep(
     repo_name = "com_google_absl",
 )
 
+bazel_dep(
+    name = "benchmark",
+    version = "1.9.1",
+    dev_dependency = True,
+    repo_name = "com_google_benchmark",
+)
+
 wycheproof_extension = use_extension(
     "//:extensions.bzl",
     "wycheproof_extension",

cmake/TinkWorkspace.cmake

@@ -66,6 +66,14 @@ if (TINK_BUILD_TESTS)
     )
   endif()
 
+  set(BENCHMARK_ENABLE_TESTING OFF CACHE BOOL "Tink dependency override" FORCE)
+
+  http_archive(
+      NAME benchmark
+      URL https://github.com/google/benchmark/archive/refs/tags/v1.9.1.tar.gz
+      SHA256 32131c08ee31eeff2c8968d7e874f3cb648034377dfc32a4c377fa8796d84981
+    )
+
   http_archive(
     NAME wycheproof
     URL https://github.com/google/wycheproof/archive/d8ed1ba95ac4c551db67f410c06131c3bc00a97c.zip

tink/subtle/BUILD.bazel

@@ -1029,15 +1029,19 @@ cc_test(
     deps = [
         ":common_enums",
         ":hmac_boringssl",
+        ":random",
         "//tink:mac",
         "//tink/internal:fips_utils",
         "//tink/util:secret_data",
         "//tink/util:status",
         "//tink/util:statusor",
         "//tink/util:test_matchers",
         "//tink/util:test_util",
+        "@com_google_absl//absl/log:check",
         "@com_google_absl//absl/status",
+        "@com_google_absl//absl/status:statusor",
         "@com_google_absl//absl/strings",
+        "@com_google_benchmark//:benchmark_main",
         "@com_google_googletest//:gtest_main",
     ],
 )

tink/subtle/CMakeLists.txt

@@ -975,9 +975,13 @@ tink_cc_test(
   DEPS
     tink::subtle::common_enums
     tink::subtle::hmac_boringssl
+    tink::subtle::random
     gmock
+    absl::check
     absl::status
+    absl::statusor
     absl::strings
+    benchmark::benchmark_main
     tink::core::mac
     tink::internal::fips_utils
     tink::util::secret_data

tink/subtle/hmac_boringssl_test.cc

@@ -18,16 +18,21 @@
 
 #include <cstddef>
 #include <cstdint>
+#include <memory>
 #include <string>
 #include <utility>
 
+#include "benchmark/benchmark.h"
 #include "gmock/gmock.h"
 #include "gtest/gtest.h"
+#include "absl/log/check.h"
 #include "absl/status/status.h"
+#include "absl/status/statusor.h"
 #include "absl/strings/string_view.h"
 #include "tink/internal/fips_utils.h"
 #include "tink/mac.h"
 #include "tink/subtle/common_enums.h"
+#include "tink/subtle/random.h"
 #include "tink/util/secret_data.h"
 #include "tink/util/status.h"
 #include "tink/util/statusor.h"
@@ -39,7 +44,9 @@ namespace tink {
 namespace subtle {
 namespace {
 
+using ::crypto::tink::subtle::Random;
 using ::crypto::tink::test::StatusIs;
+using ::crypto::tink::test::IsOk;
 
 class HmacBoringSslTest : public ::testing::Test {
  public:
@@ -198,6 +205,63 @@ TEST_F(HmacBoringSslTest, TestFipsFailWithoutBoringCrypto) {
 //  - Generate test vectors with key sizes larger than the block size of the
 //    hash. (HMAC hashes these keys).
 
+void HmacComputeBenchmark(benchmark::State &state, HashType hash,
+                          int key_size) {
+  absl::StatusOr<std::unique_ptr<Mac>> hmac = HmacBoringSsl::New(
+      hash, /*tag_size=*/key_size, Random::GetRandomKeyBytes(key_size));
+  CHECK_OK(hmac.status());
+  std::string data(state.range(0), 'x');
+  benchmark::DoNotOptimize(data);
+  for (auto s : state) {
+    absl::StatusOr<std::string> tag = (*hmac)->ComputeMac(data);
+    benchmark::DoNotOptimize(tag);
+    CHECK_OK(tag.status());
+  }
+  state.SetBytesProcessed(state.iterations() * state.range(0));
+}
+
+void BM_HmacSha256Compute(benchmark::State &state) {
+  HmacComputeBenchmark(state, HashType::SHA256,
+                       /*key_size=*/32);
+}
+
+void BM_HmacSha512Compute(benchmark::State &state) {
+  HmacComputeBenchmark(state, HashType::SHA512,
+                       /*key_size=*/64);
+}
+
+constexpr int64_t kMaxDataSize = 1 << 23;  // 4 MiB
+
+BENCHMARK(BM_HmacSha256Compute)->RangeMultiplier(128)->Range(32, kMaxDataSize);
+BENCHMARK(BM_HmacSha512Compute)->RangeMultiplier(128)->Range(32, kMaxDataSize);
+
+void HmacVerifyBenchmark(benchmark::State &state, HashType hash, int key_size) {
+  absl::StatusOr<std::unique_ptr<Mac>> hmac = HmacBoringSsl::New(
+      hash, /*tag_size=*/key_size, Random::GetRandomKeyBytes(key_size));
+  ASSERT_THAT(hmac.status(), IsOk());
+
+  std::string data(state.range(0), 'x');
+  absl::StatusOr<std::string> tag = (*hmac)->ComputeMac(data);
+  ASSERT_THAT(tag.status(), IsOk());
+  absl::Status status;
+  for (auto s : state) {
+    benchmark::DoNotOptimize(status = (*hmac)->VerifyMac(*tag, data));
+    CHECK_OK(status);
+  }
+  state.SetBytesProcessed(state.iterations() * state.range(0));
+}
+
+void BM_HmacSha256Verify(benchmark::State &state) {
+  HmacVerifyBenchmark(state, HashType::SHA256, /*key_size=*/32);
+}
+
+void BM_HmacSha512Verify(benchmark::State &state) {
+  HmacVerifyBenchmark(state, HashType::SHA512, /*key_size=*/64);
+}
+
+BENCHMARK(BM_HmacSha256Verify)->RangeMultiplier(128)->Range(32, kMaxDataSize);
+BENCHMARK(BM_HmacSha512Verify)->RangeMultiplier(128)->Range(32, kMaxDataSize);
+
 }  // namespace
 }  // namespace subtle
 }  // namespace tink

tink_cc_deps.bzl

@@ -112,3 +112,17 @@ def tink_cc_testonly_deps():
         strip_prefix = "googletest-1.15.2",
         url = "https://github.com/google/googletest/releases/download/v1.15.2/googletest-1.15.2.tar.gz",
     )
+
+    # -------------------------------------------------------------------------
+    # Google Benchmark.
+    # -------------------------------------------------------------------------
+    # Release from 2024-11-28.
+    maybe(
+        http_archive,
+        name = "com_google_benchmark",
+        sha256 = "32131c08ee31eeff2c8968d7e874f3cb648034377dfc32a4c377fa8796d84981",
+        strip_prefix = "benchmark-1.9.1",
+        urls = [
+            "https://github.com/google/benchmark/archive/refs/tags/v1.9.1.tar.gz",
+        ],
+    )