Re: [PATCH] lib/crypto: poly1305: Hide the mask value from compilers

[Eric Biggers <ebiggers@kernel.org>]

On Fri, Oct 30, 2026 at 09:26:37PM -0700, Eric Biggers wrote:
> poly1305_core_emit() does a constant-time select between h and h - p,
> where h is the accumulator and p is the Poly1305 prime of 2^130 - 5.
> 
> The mask used in this select isn't hidden from the compiler, though, so
> the compiler can infer that it's either all 0's or all 1's.
> 
> In theory, the compiler could then use that to recognize the select, and
> "optimize" it with a branch.
> 
> Fortunately, in practice, I couldn't find any gcc or clang options that
> made that happen.
> 
> Regardless, add OPTIMIZER_HIDE_VAR() to "hide" the value of the mask for
> safety against any future compiler optimizations.
> 
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/poly1305-donna32.c | 1 +
>  lib/crypto/poly1305-donna64.c | 1 +
>  2 files changed, 2 insertions(+)

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-next

- Eric