gzhttp: Use SHA256 as paranoid option

[klauspost]

Paranoid?

The padding size is determined by the remainder of a CRC32 of the content.

Since the payload contains elements unknown to the attacker, there is no reason to believe they can derive any information from this remainder, or predict it.

However, for those that feel uncomfortable with a CRC32 being used for this can enable "paranoid" mode which will use SHA256 for determining the padding.

The hashing itself is about 2 orders of magnitude slower, but in overall terms will maybe only reduce speed by 10%.

Paranoid mode has no effect if buffer is < 0 (non-content aware padding).

2K payload roundtrip difference:

Benchmark2kJitter-32    	   67309	     17580 ns/op	 116.50 MB/s	    3478 B/op	      17 allocs/op
Benchmark2kJitterParanoid-32    	   54398	     21564 ns/op	  94.97 MB/s	    3438 B/op	      16 allocs

[greatroar]

Wouldn't xxhash serve just as well? That's ~4x faster, according to xxhashbench.

[klauspost]

@greatroar

Not here:

Benchmark1KSum64-32    	16388875	        72.98 ns/op	14031.83 MB/s
BenchmarkCRC32/poly=Castagnoli/size=1kB/align=0-32      23923491                49.85 ns/op     20543.17 MB/s

Benchie similar to the CRC32 one:

func Benchmark1KSum64(b *testing.B) {
	data := make([]byte, 1024)
	b.SetBytes(1024)

	h := New()
	in := make([]byte, 0, h.Size())

	// Warm up
	h.Reset()
	h.Write(data)
	h.Sum(in)
	in = in[:0]
	for i := 0; i < b.N; i++ {
		h.Reset()
		h.Write(data)
		h.Sum(in)
	}
}