Re: [PATCH] lib/crypto: powerpc/poly1305: Remove BROKEN implementation

[Eric Biggers <ebiggers@kernel.org>]

On Thu, Oct 29, 2026 at 10:42:40AM +0100, Ard Biesheuvel wrote:
> On Thu, 29 Oct 2026, at 07:35, Eric Biggers wrote:
> > The PowerPC implementation of Poly1305 has been marked as BROKEN for
> > well over a year, since commit bc8169003b41 ("crypto: powerpc/poly1305 -
> > add depends on BROKEN for now").  So, it's not being built or used.
> >
> > The justification for marking it BROKEN was that it didn't work in
> > softirq context.  That still fully applies.
> >
> > However, it turns out the assembly file actually also contains logic
> > bugs that make it compute incorrect Poly1305 values in some cases.  This
> > is shown by it failing the test case test_poly1305_split_update_carry
> > (if "depends on BROKEN" is removed).  The cause of that appears to be a
> > lost carry bit in Carry_reduction.  However, there also appears to be a
> > bug in do_final_update where it incorrectly assumes v6 is fully reduced.
> >
> > In addition, poly1305_emit_64 contains a secret-dependent branch.
> >
> > Let's just drop this code.  A fixed version can be reconsidered later.
> >
> > Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> > ---
> >  lib/crypto/Kconfig                     |    6 +-
> >  lib/crypto/Makefile                    |    2 -
> >  lib/crypto/powerpc/poly1305-p10le_64.S | 1076 ------------------------
> >  lib/crypto/powerpc/poly1305.h          |   76 --
> >  4 files changed, 1 insertion(+), 1159 deletions(-)
> >  delete mode 100644 lib/crypto/powerpc/poly1305-p10le_64.S
> >  delete mode 100644 lib/crypto/powerpc/poly1305.h
> >
> 
> Reviewed-by: Ard Biesheuvel <ardb@kernel.org>

Applied to https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes

- Eric