On 18 July 2017 at 10:56, Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> wrote: > On 18 July 2017 at 10:49, Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx> wrote: >> On Wed, Jul 05, 2017 at 12:43:19AM +0100, Ard Biesheuvel wrote: >>> Implement a NEON fallback for systems that do support NEON but have >>> no support for the optional 64x64->128 polynomial multiplication >>> instruction that is part of the ARMv8 Crypto Extensions. It is based >>> on the paper "Fast Software Polynomial Multiplication on ARM Processors >>> Using the NEON Engine" by Danilo Camara, Conrado Gouvea, Julio Lopez and >>> Ricardo Dahab (https://hal.inria.fr/hal-01506572), but has been reworked >>> extensively for the AArch64 ISA. >>> >>> On a low-end core such as the Cortex-A53 found in the Raspberry Pi3, the >>> NEON based implementation is 4x faster than the table based one, and >>> is time invariant as well, making it less vulnerable to timing attacks. >>> When combined with the bit-sliced NEON implementation of AES-CTR, the >>> AES-GCM performance increases by ~2x (from 58 to 30 cycles per byte). >>> >>> Signed-off-by: Ard Biesheuvel <ard.biesheuvel@xxxxxxxxxx> >> >> This patch does not apply against cryptodev. >> > > Yeah, it implements a non-SIMD fallback which depends on the AES > refactor series. FYI I have pushed everything I have queued up locally here: https://git.kernel.org/pub/scm/linux/kernel/git/ardb/linux.git/log/?h=crypto-arm-for-v4.14 Once the crypto_xor() and AES refactor stuff looks satisfactory to you, I will repost the remaining bits, including these GCM and GHASH changes. Thanks, Ard.
