Subject: [Cfrg] Rust implementations of AES-GCM and AES-GCM-SIV built on POLYVAL

From: Tony Arcieri <[email-masked]>
Date: Sun, 6 Oct 2019 18:18:39 -0700

RFC 8452 Appendix A suggests that GHASH can be implemented in terms of
POLYVAL (by computing mulX_POLYVAL on the GHASH key and reversing GHASH
inputs/outputs), allowing POLYVAL to be the common optimization target for
both (provided you're mainly concerned with little endian architectures,
which happens to be the case for me).

I've gone ahead and done that in Rust implementations of AES-GCM and
AES-GCM-SIV:

https://crates.io/crates/aes-gcm
https://crates.io/crates/aes-gcm-siv

The underlying POLYVAL implementation supports (P)CLMUL(QDQ) on x86/x86_64
using Shay Gueron's carryless Karatsuba and fast Montgomery reduction
techniques[1]. When that isn't available, it falls back on a software
implementation adapted from BearSSL.

[1]: https://crypto.stanford.edu/RealWorldCrypto/slides/gueron.pdf

-- 
Tony Arcieri