linux/arch/arm64/crypto
Ard Biesheuvel 7c83d689c7 crypto: arm64/aes - avoid expanded lookup tables in the final round
For the final round, avoid the expanded and padded lookup tables
exported by the generic AES driver. Instead, for encryption, we can
perform byte loads from the same table we used for the inner rounds,
which will still be hot in the caches. For decryption, use the inverse
AES Sbox directly, which is 4x smaller than the inverse lookup table
exported by the generic driver.

This should significantly reduce the Dcache footprint of our code,
which makes the code more robust against timing attacks. It does not
introduce any additional module dependencies, given that we already
rely on the core AES module for the shared key expansion routines.
It also frees up register x18, which is not available as a scratch
register on all platforms, which and so avoiding it improves
shareability of this code.

Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
2017-08-04 09:27:26 +08:00
..
.gitignore crypto: arm64/sha2 - add generated .S files to .gitignore 2016-11-29 16:06:56 +08:00
aes-ce-ccm-core.S crypto: arm64/aes-ce-cipher - match round key endianness with generic code 2017-08-04 09:27:19 +08:00
aes-ce-ccm-glue.c crypto: arm64/aes-ce-ccm: add non-SIMD generic fallback 2017-08-04 09:27:21 +08:00
aes-ce-cipher.c crypto: arm64/aes-ce-cipher: add non-SIMD generic fallback 2017-08-04 09:27:20 +08:00
aes-ce-setkey.h arm64/crypto: use crypto instructions to generate AES key schedule 2014-11-06 17:25:28 +00:00
aes-ce.S crypto: arm64/aes-ce-cipher - match round key endianness with generic code 2017-08-04 09:27:19 +08:00
aes-cipher-core.S crypto: arm64/aes - avoid expanded lookup tables in the final round 2017-08-04 09:27:26 +08:00
aes-cipher-glue.c crypto: arm64/aes - add scalar implementation 2017-01-13 00:26:49 +08:00
aes-ctr-fallback.h crypto: arm64/aes-blk - add a non-SIMD fallback for synchronous CTR 2017-08-04 09:27:21 +08:00
aes-glue.c crypto: arm64/aes-blk - add a non-SIMD fallback for synchronous CTR 2017-08-04 09:27:21 +08:00
aes-modes.S crypto: arm64/aes - add NEON/Crypto Extensions CBCMAC/CMAC/XCBC driver 2017-02-11 17:50:45 +08:00
aes-neon.S crypto: arm64/aes-neon-blk - tweak performance for low end cores 2017-02-03 18:16:20 +08:00
aes-neonbs-core.S crypto: arm64/aes - don't use IV buffer to return final keystream block 2017-02-03 18:16:20 +08:00
aes-neonbs-glue.c crypto: arm64/aes-bs - implement non-SIMD fallback for AES-CTR 2017-08-04 09:27:22 +08:00
chacha20-neon-core.S crypto: arm64/chacha20 - implement NEON version based on SSE3 code 2017-01-13 00:26:48 +08:00
chacha20-neon-glue.c crypto: arm64/chacha20 - take may_use_simd() into account 2017-08-04 09:27:22 +08:00
crc32-ce-core.S crypto: arm64/crc32 - accelerated support based on x86 SSE implementation 2016-12-07 20:01:22 +08:00
crc32-ce-glue.c crypto: arm64/crc32 - add non-SIMD scalar fallback 2017-08-04 09:27:17 +08:00
crct10dif-ce-core.S crypto: arm64/crct10dif - port x86 SSE implementation to arm64 2016-12-07 20:01:17 +08:00
crct10dif-ce-glue.c crypto: arm64/crct10dif - add non-SIMD generic fallback 2017-08-04 09:27:16 +08:00
ghash-ce-core.S crypto: arm64/ghash - add NEON accelerated fallback for 64-bit PMULL 2017-08-04 09:27:25 +08:00
ghash-ce-glue.c crypto: arm64/ghash - add NEON accelerated fallback for 64-bit PMULL 2017-08-04 09:27:25 +08:00
Kconfig crypto: arm64/gcm - implement native driver using v8 Crypto Extensions 2017-08-04 09:27:23 +08:00
Makefile crypto: arm64/crc32 - merge CRC32 and PMULL instruction based drivers 2017-02-11 17:50:38 +08:00
sha1-ce-core.S crypto: arm64/sha - avoid non-standard inline asm tricks 2017-05-18 13:19:52 +08:00
sha1-ce-glue.c crypto: arm64/sha1-ce - add non-SIMD generic fallback 2017-08-04 09:27:18 +08:00
sha2-ce-core.S crypto: arm64/sha - avoid non-standard inline asm tricks 2017-05-18 13:19:52 +08:00
sha2-ce-glue.c crypto: arm64/sha2-ce - add non-SIMD scalar fallback 2017-08-04 09:27:19 +08:00
sha256-core.S_shipped crypto: arm64/sha2 - integrate OpenSSL implementations of SHA256/SHA512 2016-11-28 19:58:05 +08:00
sha256-glue.c crypto: arm64/sha2-ce - add non-SIMD scalar fallback 2017-08-04 09:27:19 +08:00
sha512-armv8.pl crypto: arm64/sha2 - integrate OpenSSL implementations of SHA256/SHA512 2016-11-28 19:58:05 +08:00
sha512-core.S_shipped crypto: arm64/sha2 - integrate OpenSSL implementations of SHA256/SHA512 2016-11-28 19:58:05 +08:00
sha512-glue.c crypto: arm64/sha2 - integrate OpenSSL implementations of SHA256/SHA512 2016-11-28 19:58:05 +08:00