Changes in gf128hash.c

c417e7045b70345f59643fb2db67b0e7fbd7fbd0 - lib/crypto: gf128hash: Add GHASH support

Thu, 19 Mar 2026 06:17:04 +0000

lib/crypto: gf128hash: Add GHASH supportAdd GHASH support to the gf128hash module.This will replace the GHASH support in the crypto_shash API. It will beused by the "gcm" template and by the AES-GCM library (when anarch-optimized implementation of the full AES-GCM is unavailable).This consists of a simple API that mirrors the existing POLYVAL API, ageneric implementation of that API based on the existing efficient andside-channel-resistant polyval_mul_generic(), and the framework forarchitecture-optimized implementations of the GHASH functions.The GHASH accumulator is stored in POLYVAL format rather than GHASHformat, since this is what most modern GHASH implementations actuallyneed. The few implementations that expect the accumulator in GHASHformat will just convert the accumulator to/from GHASH formattemporarily. (Supporting architecture-specific accumulator formatswould be possible, but doesn't seem worth the complexity.)However, architecture-specific formats of struct ghash_key will besupported, since a variety of formats will be needed there anyway. Thedefault format is just the key in POLYVAL format.Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-4-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/lib/crypto/gf128hash.c

b3b6e8f9b38911e9b30a5abe845541ade0797327 - lib/crypto: gf128hash: Support GF128HASH_ARCH without all POLYVAL functions

Thu, 19 Mar 2026 06:17:03 +0000

lib/crypto: gf128hash: Support GF128HASH_ARCH without all POLYVAL functionsCurrently, some architectures (arm64 and x86) have optimized code forboth GHASH and POLYVAL. Others (arm, powerpc, riscv, and s390) haveoptimized code only for GHASH. While POLYVAL support could beimplemented on these other architectures, until then we need to supportthe case where arch-optimized functions are present only for GHASH.Therefore, update the support for arch-optimized POLYVAL functions toallow architectures to opt into supporting these functions individually.The new meaning of CONFIG_CRYPTO_LIB_GF128HASH_ARCH is that some levelof GHASH and/or POLYVAL acceleration is provided.Also provide an implementation of polyval_mul() based onpolyval_blocks_arch(), for when polyval_mul_arch() isn't implemented.Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-3-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/lib/crypto/gf128hash.c

61f66c5216a961784b12307be60a25204525605c - lib/crypto: gf128hash: Rename polyval module to gf128hash

Thu, 19 Mar 2026 06:17:02 +0000

lib/crypto: gf128hash: Rename polyval module to gf128hashCurrently, the standalone GHASH code is coupled with crypto_shash. Thishas resulted in unnecessary complexity and overhead, as well as the codebeing unavailable to library code such as the AES-GCM library. Like wasdone with POLYVAL, it needs to find a new home in lib/crypto/.GHASH and POLYVAL are closely related and can each be implemented interms of each other. Optimized code for one can be reused with theother. But also since GHASH tends to be difficult to implement directlydue to its unnatural bit order, most modern GHASH implementations(including the existing arm, arm64, powerpc, and x86 optimized GHASHcode, and the new generic GHASH code I'll be adding) actuallyreinterpret the GHASH computation as an equivalent POLYVAL computation,pre and post-processing the inputs and outputs to map to/from POLYVAL.Given this close relationship, it makes sense to group the GHASH andPOLYVAL code together in the same module. This gives us a wide range ofoptions for implementing them, reusing code between the two and properlyutilizing whatever instructions each architecture provides.Thus, GHASH support will be added to the library module that iscurrently called "polyval". Rename it to an appropriate name:"gf128hash". Rename files, options, functions, etc. where appropriateto reflect the upcoming sharing with GHASH. (Note: polyval_kunit is notrenamed, as ghash_kunit will be added alongside it instead.)Acked-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20260319061723.1140720-2-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/lib/crypto/gf128hash.c

3d176751e541362ff40c2478d6a2de41f8c62318 - lib/crypto: polyval: Add POLYVAL library

Sun, 09 Nov 2025 23:47:17 +0000

lib/crypto: polyval: Add POLYVAL libraryAdd support for POLYVAL to lib/crypto/.This will replace the polyval crypto_shash algorithm and its use in thehctr2 template, simplifying the code and reducing overhead.Specifically, this commit introduces the POLYVAL library API and ageneric implementation of it. Later commits will migrate the existingarchitecture-optimized implementations of POLYVAL into lib/crypto/ andadd a KUnit test suite.I've also rewritten the generic implementation completely, using a moremodern approach instead of the traditional table-based approach. It'snow constant-time, requires no precomputation or dynamic memoryallocations, decreases the per-key memory usage from 4096 bytes to 16bytes, and is faster than the old polyval-generic even on bulk datareusing the same key (at least on x86_64, where I measured 15% faster).We should do this for GHASH too, but for now just do it for POLYVAL.Reviewed-by: Ard Biesheuvel Tested-by: Ard Biesheuvel Link: https://lore.kernel.org/r/20251109234726.638437-3-ebiggers@kernel.orgSigned-off-by: Eric Biggers List of files: /linux/lib/crypto/gf128hash.c