92f23b71ab
Add hardware accelerated version of POLYVAL for x86-64 CPUs with PCLMULQDQ support. This implementation is accelerated using PCLMULQDQ instructions to perform the finite field computations. For added efficiency, 8 blocks of the message are processed simultaneously by precomputing the first 8 powers of the key. Schoolbook multiplication is used instead of Karatsuba multiplication because it was found to be slightly faster on x86-64 machines. Montgomery reduction must be used instead of Barrett reduction due to the difference in modulus between POLYVAL's field and other finite fields. More information on POLYVAL can be found in the HCTR2 paper: "Length-preserving encryption with HCTR2": https://eprint.iacr.org/2021/1441.pdf Signed-off-by: Nathan Huckleberry <nhuck@google.com> Reviewed-by: Ard Biesheuvel <ardb@kernel.org> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Bug: 233652475 Link: https://lore.kernel.org/linux-arm-kernel/20220520181501.2159644-4-nhuck@google.com/T/ (cherry picked from commit 34f7f6c3011276313383099156be287ac745bcea) Change-Id: I18a532b8338e62ca7c85d8106ef22eeeab7b3355 Signed-off-by: Nathan Huckleberry <nhuck@google.com>
23 lines
445 B
C
23 lines
445 B
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
* Common values for the Polyval hash algorithm
|
|
*
|
|
* Copyright 2021 Google LLC
|
|
*/
|
|
|
|
#ifndef _CRYPTO_POLYVAL_H
|
|
#define _CRYPTO_POLYVAL_H
|
|
|
|
#include <linux/types.h>
|
|
#include <linux/crypto.h>
|
|
|
|
#define POLYVAL_BLOCK_SIZE 16
|
|
#define POLYVAL_DIGEST_SIZE 16
|
|
|
|
void polyval_mul_non4k(u8 *op1, const u8 *op2);
|
|
|
|
void polyval_update_non4k(const u8 *key, const u8 *in,
|
|
size_t nblocks, u8 *accumulator);
|
|
|
|
#endif
|