kern/60668: opencrypto/gmac issues

["campbell+netbsd%mumble.net@localhost via gnats" <gnats-admin%NetBSD.org@localhost>]

>Number:         60668
>Category:       kern
>Synopsis:       opencrypto/gmac issues
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 29 14:35:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
Galois/NetBSD Mode, Inc.
>Environment:
>Description:

	1. ghash_gfmul runs with variable secret-dependent time -- both
	   inputs X and Y are secret, and there is a conditional branch
	   that depends on X[i >> 6] or X[i >> 5] (depending on the
	   integer size):

     49 #if GMAC_INTLEN == 8
     50 		if (X[i >> 6] & (1ULL << (~i & 63))) {
     51 			product[0] ^= v[0];
     52 			product[1] ^= v[1];
     53 		} /* else: we preserve old values */
     54 #else
     55 		if (X[i >> 5] & (1 << (~i & 31))) {
     56 			product[0] ^= v[0];
     57 			product[1] ^= v[1];
     58 			product[2] ^= v[2];
     59 			product[3] ^= v[3];
     60 		} /* else: we preserve old values */
     61 #endif

	   https://nxr.netbsd.org/xref/src/sys/opencrypto/gmac.c?r=1.4#47

	2. The GHASH computation in software has got to be abysmally
	   slow by computing the GF(2^128) product bit by bit.

>How-To-Repeat:

	code inspection

>Fix:

	0. Adopt power-on self-tests for GHASH, AES-GMAC, and AES-GCM.

	1. Replace the conditional branch by masked arithmetic:

	   /* mask is all-zero if X[i >> 6] has bit ~i set, else all-one */
	   mask = (X[i >> 6] >> (~i & 63)) - 1;
	   product[0] ^= v[0] & ~mask;
	   product[1] ^= v[1] & ~mask;

	2. Extend aes(9) with machine-dependent vectorized
	   implementations of GHASH, e.g. using x86 CLMUL carryless
	   multiplication instructions.