[PATCH] lib/crypto: gf128hash: Hide selection mask values from compilers

[PATCH] lib/crypto: gf128hash: Hide selection mask values from compilers

[Eric Biggers]

Hide selection mask values from compilers, so that they cannot see that
they are used to select between two values and potentially generate a
secret-dependent branch.  This is not known to be happening here, but we
might as well be extra careful.

Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
 lib/crypto/gf128hash.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/lib/crypto/gf128hash.c b/lib/crypto/gf128hash.c
index 8dcdf5ec98be..5b8ae98cafed 100644
--- a/lib/crypto/gf128hash.c
+++ b/lib/crypto/gf128hash.c
@@ -88,10 +88,18 @@ static void clmul64(u64 a, u64 b, u64 *out_lo, u64 *out_hi)
 		  (a2 * (u128)b1) ^ (a3 * (u128)b0);
 
 	/* Multiply the low 4 bits of @a by @b. */
-	u64 e0 = -(a & 1) & b;
-	u64 e1 = -((a >> 1) & 1) & b;
-	u64 e2 = -((a >> 2) & 1) & b;
-	u64 e3 = -((a >> 3) & 1) & b;
+	u64 e0 = -(a & 1);
+	u64 e1 = -((a >> 1) & 1);
+	u64 e2 = -((a >> 2) & 1);
+	u64 e3 = -((a >> 3) & 1);
+	OPTIMIZER_HIDE_VAR(e0);
+	OPTIMIZER_HIDE_VAR(e1);
+	OPTIMIZER_HIDE_VAR(e2);
+	OPTIMIZER_HIDE_VAR(e3);
+	e0 &= b;
+	e1 &= b;
+	e2 &= b;
+	e3 &= b;
 	u64 extra_lo = e0 ^ (e1 << 1) ^ (e2 << 2) ^ (e3 << 3);
 	u64 extra_hi = (e1 >> 63) ^ (e2 >> 62) ^ (e3 >> 61);
 
@@ -245,6 +253,7 @@ static void __maybe_unused ghash_key_to_polyval(const u8 in[GHASH_BLOCK_SIZE],
 	u64 lo = get_unaligned_be64(&in[8]);
 	u64 mask = (s64)hi >> 63;
 
+	OPTIMIZER_HIDE_VAR(mask);
 	hi = (hi << 1) ^ (lo >> 63) ^ (mask & ((u64)0xc2 << 56));
 	lo = (lo << 1) ^ (mask & 1);
 	out->lo = cpu_to_le64(lo);

base-commit: 2a500a04d6f969318c05f46aedb6e73fc1963a00
-- 
2.56.0

Re: [PATCH] lib/crypto: gf128hash: Hide selection mask values from compilers

[Ard Biesheuvel]

On Sat, 31 Oct 2026, at 06:21, Eric Biggers wrote:
> Hide selection mask values from compilers, so that they cannot see that
> they are used to select between two values and potentially generate a
> secret-dependent branch.  This is not known to be happening here, but we
> might as well be extra careful.
>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/gf128hash.c | 17 +++++++++++++----
>  1 file changed, 13 insertions(+), 4 deletions(-)
>

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>


> diff --git a/lib/crypto/gf128hash.c b/lib/crypto/gf128hash.c
> index 8dcdf5ec98be..5b8ae98cafed 100644
> --- a/lib/crypto/gf128hash.c
> +++ b/lib/crypto/gf128hash.c
> @@ -88,10 +88,18 @@ static void clmul64(u64 a, u64 b, u64 *out_lo, u64 *out_hi)
>  		  (a2 * (u128)b1) ^ (a3 * (u128)b0);
> 
>  	/* Multiply the low 4 bits of @a by @b. */
> -	u64 e0 = -(a & 1) & b;
> -	u64 e1 = -((a >> 1) & 1) & b;
> -	u64 e2 = -((a >> 2) & 1) & b;
> -	u64 e3 = -((a >> 3) & 1) & b;
> +	u64 e0 = -(a & 1);
> +	u64 e1 = -((a >> 1) & 1);
> +	u64 e2 = -((a >> 2) & 1);
> +	u64 e3 = -((a >> 3) & 1);
> +	OPTIMIZER_HIDE_VAR(e0);
> +	OPTIMIZER_HIDE_VAR(e1);
> +	OPTIMIZER_HIDE_VAR(e2);
> +	OPTIMIZER_HIDE_VAR(e3);
> +	e0 &= b;
> +	e1 &= b;
> +	e2 &= b;
> +	e3 &= b;
>  	u64 extra_lo = e0 ^ (e1 << 1) ^ (e2 << 2) ^ (e3 << 3);
>  	u64 extra_hi = (e1 >> 63) ^ (e2 >> 62) ^ (e3 >> 61);
> 
> @@ -245,6 +253,7 @@ static void __maybe_unused 
> ghash_key_to_polyval(const u8 in[GHASH_BLOCK_SIZE],
>  	u64 lo = get_unaligned_be64(&in[8]);
>  	u64 mask = (s64)hi >> 63;
> 
> +	OPTIMIZER_HIDE_VAR(mask);
>  	hi = (hi << 1) ^ (lo >> 63) ^ (mask & ((u64)0xc2 << 56));
>  	lo = (lo << 1) ^ (mask & 1);
>  	out->lo = cpu_to_le64(lo);
>
> base-commit: 2a500a04d6f969318c05f46aedb6e73fc1963a00
> -- 
> 2.56.0

Re: [PATCH] lib/crypto: gf128hash: Hide selection mask values from compilers

[Eric Biggers]

On Fri, Oct 30, 2026 at 10:21:49PM -0700, Eric Biggers wrote:
> Hide selection mask values from compilers, so that they cannot see that
> they are used to select between two values and potentially generate a
> secret-dependent branch.  This is not known to be happening here, but we
> might as well be extra careful.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/gf128hash.c | 17 +++++++++++++----
>  1 file changed, 13 insertions(+), 4 deletions(-)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric