• Ard Biesheuvel's avatar
    crypto: arm/aes - avoid expanded lookup tables in the final round · 0d149ce6
    Ard Biesheuvel authored
    For the final round, avoid the expanded and padded lookup tables
    exported by the generic AES driver. Instead, for encryption, we can
    perform byte loads from the same table we used for the inner rounds,
    which will still be hot in the caches. For decryption, use the inverse
    AES Sbox directly, which is 4x smaller than the inverse lookup table
    exported by the generic driver.
    
    This should significantly reduce the Dcache footprint of our code,
    which makes the code more robust against timing attacks. It does not
    introduce any additional module dependencies, given that we already
    rely on the core AES module for the shared key expansion routines.
    Signed-off-by: default avatarArd Biesheuvel <ard.biesheuvel@linaro.org>
    Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
    0d149ce6
aes-cipher-core.S 5.53 KB