mirror of
https://github.com/wolfSSL/wolfssl.git
synced 2026-10-24 04:09:07 +03:00
3cea47a49e
CONFIG_WOLFSSL_AES_CONSTANT_TIME left two holes that the option and wolfPSA's psa_config.h check both missed. GHASH. The module hardcoded GCM_SMALL, whose GMULT branches on every bit of the hash subkey H. WOLFSSL_AES_TOUCH_LINES and WC_AES_BITSLICED only change the AES block cipher core, so AES-GCM was not constant time with the option on. The only constant-time C GHASH is the masked bitwise multiply wolfCrypt builds when no GCM method is defined. Add a GHASH choice. It defaults to that bitwise multiply, and offers the 4-bit and 8-bit tables as opt-ins that depend on !WOLFSSL_AES_CONSTANT_TIME. GCM_SMALL is no longer offered on plain C builds: it is not constant time either, and in a host autoconf build its GMAC ran at 16.6 MiB/s against 162 MiB/s for the bitwise multiply and 726 MiB/s for the 4-bit table. Assembly. With CONFIG_WOLFCRYPT_ASM on Arm the Thumb2, ARM32 and AArch64 assembly replaces the C AES core outright, and it indexes 1 KB T-tables with secret data. wolfCrypt has no macro to drop only the AES assembly, and the build accepted touch-lines alongside it without a word: on mps2/an521 the image linked AES_encrypt_block and L_AES_Thumb2_te_data. GHASH under the Arm assembly is a table or the bitwise multiply that branches on H, never the masked one. So the constant-time option is no longer available where the module builds the Arm symmetric assembly - ARMv7-M and ARMv8-M mainline, 32-bit Cortex-A/R and AArch64 - and the GHASH choice defaults to the 4-bit table there, with GCM_SMALL kept as a tableless option. A hidden WOLFCRYPT_ARM_SYMMETRIC_ASM now holds that core list, and user_settings.h and CMakeLists.txt test it instead of repeating the condition. AArch64 parts with the crypto extension lose the option too, because Kconfig cannot see that compiler feature. ARMv6-M and ARMv8-M baseline keep it: they get assembly for the SP math only. x86_64 is unaffected: USE_INTEL_SPEEDUP leaves the C AES core in place, so touch-lines takes effect. FIPS v2 and v5 pin an aes.c older than the masked multiply: v5 builds it only under AES_GCM_GMULT_CT and v2 not at all. Both keep GCM_SMALL as their default, so a validated build keeps its boundary object. Under v5 the constant-time choice also defines AES_GCM_GMULT_CT; under v2 it is not offered, and neither is the 4-bit table, which v2's aes.c predates. FIPS v6 and later have the masked multiply by default and can still pick GCM_SMALL to keep an existing boundary object. A configuration that set both options now gets a Kconfig warning and the option turned off, instead of table-based AES under a constant-time label. New wolfssl_test scenarios cover the two tables and the constant-time AES core on qemu_x86, and the 8-bit table under the Thumb2 and AArch64 assembly. All thirteen wolfssl_test scenarios pass on qemu_x86, qemu_x86_64, qemu_cortex_a53 and mps2/an521/cpu0, and the symbols confirm each one linked the GHASH it selected.