Repository navigation
Conversation
Table-free GHASH multiply using integer multiplies on operands masked to every fourth bit aes.h now picks the GHASH implementation when none is chosen GCM_INT_MUL when WC_AES_GCM_GMULT_CACHE_RESIST is set (default), otherwise GCM_TABLE_4BIT. PPC/RISC-V/Arm asm builds keep GCM_TABLE_4BIT. Opt out with WC_NO_CACHE_RESISTANT (--disable-harden) or the new AES_GCM_GMULT_NO_CACHE_RESIST. GCM_SMALL and GCM_WORD32 GMULT: mask instead of branching on H/state when cache resistant. AES-GCM-SIV POLYVAL uses the GCM_INT_MUL multiply when it is compiled. configure/CMake: add --enable-aesgcm=intmul; by default pass no GHASH selector and let aes.h decide (FIPS keeps GCM_TABLE_4BIT). CMake no longer forces 4bit over an explicit choice on little-endian.
SparkiDev
force-pushed
the
aes_gcm_ghash_int_mul
branch
from
November 11, 2026 02:21
53ba1fc to
5a7a1ce
Compare
|
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
Critical GHASH defects produce incorrect authentication tags on supported 16-bit-byte targets, while the missing generated-header selector can create incompatible library and application layouts.
3 open issues
What changed in this PR
Adds a table-free integer-multiply GHASH implementation to wolfCrypt and makes it the default for cache-resistant software AES-GCM configurations.
Changes:
- Implements
GCM_INT_MULfor GHASH and reuses it for AES-GCM-SIV POLYVAL. - Replaces secret-dependent branches with masks in cache-resistant
GCM_SMALLandGCM_WORD32multiplication. - Adds build-system selection and benchmark labeling for intmul, while preserving assembly and FIPS defaults.
| File | Description |
|---|---|
wolfssl/wolfcrypt/aes.h |
Selects the default GHASH implementation and defines cache-resistance controls. |
wolfcrypt/src/aes.c |
Implements integer-multiply GHASH, POLYVAL reuse, and branch-free masking. |
wolfcrypt/benchmark/benchmark.c |
Labels intmul GMAC benchmark results. |
configure.ac |
Adds intmul selection and delegates non-FIPS defaults to aes.h. |
CMakeLists.txt |
Adds intmul selection and preserves explicit GHASH choices. |
Review effort: Balanced
| endif() | ||
|
|
||
| if("${WOLFSSL_AESGCM}" STREQUAL "intmul") | ||
| list(APPEND WOLFSSL_DEFINITIONS "-DGCM_INT_MUL") |
| { | ||
| #ifdef WC_AES_GCM_GMULT_CACHE_RESIST | ||
| /* Y is H: select V with a mask rather than branching on it. */ | ||
| byte mask = (byte)(0U - (byte)(y >> 7)); |
| typedef word32 GcmImWord; | ||
| #endif | ||
| /* Number of words in a block. */ | ||
| #define GCM_IM_WORDS ((int)(WC_AES_BLOCK_SIZE / sizeof(GcmImWord))) |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Table-free GHASH multiply using integer multiplies on operands masked to every fourth bit
aes.h now picks the GHASH implementation when none is chosen GCM_INT_MUL when WC_AES_GCM_GMULT_CACHE_RESIST is set (default), otherwise GCM_TABLE_4BIT. PPC/RISC-V/Arm asm builds keep GCM_TABLE_4BIT. Opt out with WC_NO_CACHE_RESISTANT (--disable-harden) or the new AES_GCM_GMULT_NO_CACHE_RESIST.
GCM_SMALL and GCM_WORD32 GMULT: mask instead of branching on H/state when cache resistant.
AES-GCM-SIV POLYVAL uses the GCM_INT_MUL multiply when it is compiled.
configure/CMake: add --enable-aesgcm=intmul; by default pass no GHASH selector and let aes.h decide (FIPS keeps GCM_TABLE_4BIT). CMake no longer forces 4bit over an explicit choice on little-endian.
Fixes zd#22771
Testing
./configure --enable-aes-gcm=4bit
./configure --enable-aes-gcm=word32
./configure --enable-aes-gcm=small
./configure --enable-aes-gcm=intmul