Re: [PATCH 00/19] GHASH library

Ard Biesheuvel
2026-03-23T14:14:48Z

On Thu, 19 Mar 2026, at 07:17, Eric Biggers wrote:
> This series is targeting libcrypto-next. It can also be retrieved from:
>
> git fetch
> https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git
> ghash-lib-v1
>
> This series migrates the standalone GHASH code to lib/crypto/, then
> converts the "gcm" template and AES-GCM library code to use it. (GHASH
> is the universal hash function used by GCM mode.) As was the case with
> POLYVAL and Poly1305 as well, the library is a much better fit for it.
>
> Since GHASH and POLYVAL are closely related and it often makes sense to
> implement one in terms of the other, the existing "polyval" library
> module is renamed to "gf128hash" and the GHASH support is added to it.
>
> The generic implementation of GHASH is also replaced with a better one
> utilizing the existing polyval_mul_generic().
>
> Note that some GHASH implementations, often faster ones using more
> recent CPU features, still exist in arch/*/crypto/ as internal
> components of AES-GCM implementations. Those are left as-is for now.
> The goal with this GHASH library is just to provide parity with the
> existing standalone GHASH support, which is used when a full
> implementation of AES-GCM (or ${someothercipher}-GCM, if another block
> cipher is being used) is unavailable. Migrating the
> architecture-optimized AES-GCM code to lib/crypto/ will be a next step.
>
> Eric Biggers (19):
> lib/crypto: gf128hash: Rename polyval module to gf128hash
> lib/crypto: gf128hash: Support GF128HASH_ARCH without all POLYVAL
> functions
> lib/crypto: gf128hash: Add GHASH support
> lib/crypto: tests: Add KUnit tests for GHASH
> crypto: arm/ghash - Make the "ghash" crypto_shash NEON-only
> crypto: arm/ghash - Move NEON GHASH assembly into its own file
> lib/crypto: arm/ghash: Migrate optimized code into library
> crypto: arm64/ghash - Move NEON GHASH assembly into its own file
> lib/crypto: arm64/ghash: Migrate optimized code into library
> crypto: arm64/aes-gcm - Rename struct ghash_key and make fixed-sized
> lib/crypto: powerpc/ghash: Migrate optimized code into library
> lib/crypto: riscv/ghash: Migrate optimized code into library
> lib/crypto: s390/ghash: Migrate optimized code into library
> lib/crypto: x86/ghash: Migrate optimized code into library
> crypto: gcm - Use GHASH library instead of crypto_ahash
> crypto: ghash - Remove ghash from crypto_shash API
> lib/crypto: gf128mul: Remove unused 4k_lle functions
> lib/crypto: gf128hash: Remove unused content from ghash.h
> lib/crypto: aesgcm: Use GHASH library API
>

Acked-by: Ard Biesheuvel <ardb@kernel.org>