• Ard Biesheuvel's avatar
    crypto: arm64/aes - avoid expanded lookup tables in the final round · 7c83d689
    Ard Biesheuvel authored
    For the final round, avoid the expanded and padded lookup tables
    exported by the generic AES driver. Instead, for encryption, we can
    perform byte loads from the same table we used for the inner rounds,
    which will still be hot in the caches. For decryption, use the inverse
    AES Sbox directly, which is 4x smaller than the inverse lookup table
    exported by the generic driver.
    This should significantly reduce the Dcache footprint of our code,
    which makes the code more robust against timing attacks. It does not
    introduce any additional module dependencies, given that we already
    rely on the core AES module for the shared key expansion routines.
    It also frees up register x18, which is not available as a scratch
    register on all platforms, which and so avoiding it improves
    shareability of this code.
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
aes-cipher-core.S 5.25 KB