kern/59774: bearssl 32-bit AES is too slow, want 64-bit optimized version in kernel

[nia%pkgsrc.org@localhost]

>Number:         59774
>Category:       kern
>Synopsis:       bearssl 32-bit AES is too slow, want 64-bit optimized version in kernel
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Tue Nov 18 18:25:00 +0000 2025
>Originator:     nia
>Release:        netbsd-11, netbsd-10...
>Organization:
The NetBSD SPARCstation
>Environment:
>Description:
32-bit bearSSL AES is extremely slow on architectures like sparc64.
It would be nice to have the 64-bit version, which has around twice
the throughput in my preliminary tests. Unfortunately the kernel
relies on implementations of encryption modes (CCM, XTS) that
BearSSL doesn't support, so this isn't as simple as just dropping
the implementation in.

The OpenSSL sparcv9 AES and sparc-optimized implementation of AES from
Daniel J. Bernstein are even faster. However, they don't promise
to be completely constant-time, only "side-channel resistant" with
compressed sboxes, L2 cache scheduling, and prefetching.
>How-To-Repeat:

>Fix:
write an implementation of XTS and CCM for 64-bit BearSSL AES