NetBSD Problem Report #60668

From www@netbsd.org  Sat Aug 29 14:34:52 2026
Return-Path: <www@netbsd.org>
Received: from mail.netbsd.org (mail.netbsd.org [199.233.217.200])
	(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
	 key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256
	 client-signature RSA-PSS (2048 bits) client-digest SHA256)
	(Client CN "mail.netbsd.org", Issuer "YR2" (not verified))
	by mollari.NetBSD.org (Postfix) with ESMTPS id 686E11A923C
	for <gnats-bugs@gnats.NetBSD.org>; Sat, 29 Aug 2026 14:34:52 +0000 (UTC)
Message-Id: <20260829143451.068171A923E@mollari.NetBSD.org>
Date: Sat, 29 Aug 2026 14:34:50 +0000 (UTC)
From: campbell+netbsd@mumble.net
Reply-To: campbell+netbsd@mumble.net
To: gnats-bugs@NetBSD.org
Subject: opencrypto/gmac issues
X-Send-Pr-Version: www-1.0
X-From4GNATS: "campbell+netbsd@mumble.net via gnats" <gnats-admin@NetBSD.org>

>Number:         60668
>Category:       kern
>Synopsis:       opencrypto/gmac issues
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    kern-bug-people
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Sat Aug 29 14:35:00 +0000 2026
>Originator:     Taylor R Campbell
>Release:        current, 11, 10, 9, ...
>Organization:
Galois/NetBSD Mode, Inc.
>Environment:
>Description:

	1. ghash_gfmul runs with variable secret-dependent time -- both
	   inputs X and Y are secret, and there is a conditional branch
	   that depends on X[i >> 6] or X[i >> 5] (depending on the
	   integer size):

     49 #if GMAC_INTLEN == 8
     50 		if (X[i >> 6] & (1ULL << (~i & 63))) {
     51 			product[0] ^= v[0];
     52 			product[1] ^= v[1];
     53 		} /* else: we preserve old values */
     54 #else
     55 		if (X[i >> 5] & (1 << (~i & 31))) {
     56 			product[0] ^= v[0];
     57 			product[1] ^= v[1];
     58 			product[2] ^= v[2];
     59 			product[3] ^= v[3];
     60 		} /* else: we preserve old values */
     61 #endif

	   https://nxr.netbsd.org/xref/src/sys/opencrypto/gmac.c?r=1.4#47

	2. The GHASH computation in software has got to be abysmally
	   slow by computing the GF(2^128) product bit by bit.

>How-To-Repeat:

	code inspection

>Fix:

	0. Adopt power-on self-tests for GHASH, AES-GMAC, and AES-GCM.

	1. Replace the conditional branch by masked arithmetic:

	   /* mask is all-zero if X[i >> 6] has bit ~i set, else all-one */
	   mask = (X[i >> 6] >> (~i & 63)) - 1;
	   product[0] ^= v[0] & ~mask;
	   product[1] ^= v[1] & ~mask;

	2. Extend aes(9) with machine-dependent vectorized
	   implementations of GHASH, e.g. using x86 CLMUL carryless
	   multiplication instructions.

Home	PR Database Search