Re: [PATCH] lib/crypto: powerpc/poly1305: Remove BROKEN implementation

["Ard Biesheuvel" <ardb@kernel.org>]

On Thu, 29 Oct 2026, at 07:35, Eric Biggers wrote:
> The PowerPC implementation of Poly1305 has been marked as BROKEN for
> well over a year, since commit bc8169003b41 ("crypto: powerpc/poly1305 -
> add depends on BROKEN for now").  So, it's not being built or used.
>
> The justification for marking it BROKEN was that it didn't work in
> softirq context.  That still fully applies.
>
> However, it turns out the assembly file actually also contains logic
> bugs that make it compute incorrect Poly1305 values in some cases.  This
> is shown by it failing the test case test_poly1305_split_update_carry
> (if "depends on BROKEN" is removed).  The cause of that appears to be a
> lost carry bit in Carry_reduction.  However, there also appears to be a
> bug in do_final_update where it incorrectly assumes v6 is fully reduced.
>
> In addition, poly1305_emit_64 contains a secret-dependent branch.
>
> Let's just drop this code.  A fixed version can be reconsidered later.
>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
> ---
>  lib/crypto/Kconfig                     |    6 +-
>  lib/crypto/Makefile                    |    2 -
>  lib/crypto/powerpc/poly1305-p10le_64.S | 1076 ------------------------
>  lib/crypto/powerpc/poly1305.h          |   76 --
>  4 files changed, 1 insertion(+), 1159 deletions(-)
>  delete mode 100644 lib/crypto/powerpc/poly1305-p10le_64.S
>  delete mode 100644 lib/crypto/powerpc/poly1305.h
>

Reviewed-by: Ard Biesheuvel <ardb@kernel.org>