From 8b93d4510d862276d1182863542fbee0fee39a26 Mon Sep 17 00:00:00 2001 From: Sean Parkinson Date: Thu, 30 Jun 2022 09:29:04 +1000 Subject: [PATCH] AES-GCM: make word implementation of GMULT constant time If performance is impacted then define: AES_GCM_GMULT_NCT --- wolfcrypt/src/aes.c | 20 +------------------- 1 file changed, 1 insertion(+), 19 deletions(-) diff --git a/wolfcrypt/src/aes.c b/wolfcrypt/src/aes.c index f9e5cfec0..caaa98c21 100644 --- a/wolfcrypt/src/aes.c +++ b/wolfcrypt/src/aes.c @@ -6619,9 +6619,7 @@ static void GMULT(word64* X, word64* Y) word64 Z[2] = {0,0}; word64 V[2]; int i, j; -#ifdef AES_GCM_GMULT_CT word64 v1; -#endif V[0] = X[0]; V[1] = X[1]; for (i = 0; i < 2; i++) @@ -6629,7 +6627,7 @@ static void GMULT(word64* X, word64* Y) word64 y = Y[i]; for (j = 0; j < 64; j++) { -#ifdef AES_GCM_GMULT_CT +#ifndef AES_GCM_GMULT_NCT word64 mask = 0 - (y >> 63); Z[0] ^= V[0] & mask; Z[1] ^= V[1] & mask; @@ -6640,27 +6638,11 @@ static void GMULT(word64* X, word64* Y) } #endif -#ifdef AES_GCM_GMULT_CT v1 = (0 - (V[1] & 1)) & 0xE100000000000000ULL; V[1] >>= 1; V[1] |= V[0] << 63; V[0] >>= 1; V[0] ^= v1; -#else - if (V[1] & 0x0000000000000001) { - V[1] >>= 1; - V[1] |= ((V[0] & 0x0000000000000001) ? - 0x8000000000000000ULL : 0); - V[0] >>= 1; - V[0] ^= 0xE100000000000000ULL; - } - else { - V[1] >>= 1; - V[1] |= ((V[0] & 0x0000000000000001) ? - 0x8000000000000000ULL : 0); - V[0] >>= 1; - } -#endif y <<= 1; } }