On Thu, 29 Oct 2026, at 07:35, Eric Biggers wrote:
> The PowerPC implementation of Poly1305 has been marked as BROKEN for
> well over a year, since commit bc8169003b41 ("crypto: powerpc/poly1305 -
> add depends on BROKEN for now"). So, it's not being built or used.
>
> The justification for marking it BROKEN was that it didn't work in
> softirq context. That still fully applies.
>
> However, it turns out the assembly file actually also contains logic
> bugs that make it compute incorrect Poly1305 values in some cases. This
> is shown by it failing the test case test_poly1305_split_update_carry
> (if "depends on BROKEN" is removed). The cause of that appears to be a
> lost carry bit in Carry_reduction. However, there also appears to be a
> bug in do_final_update where it incorrectly assumes v6 is fully reduced.
>
> In addition, poly1305_emit_64 contains a secret-dependent branch.
>
> Let's just drop this code. A fixed version can be reconsidered later.
>
> Signed-off-by: Eric Biggers <[email protected]>
> ---
> lib/crypto/Kconfig | 6 +-
> lib/crypto/Makefile | 2 -
> lib/crypto/powerpc/poly1305-p10le_64.S | 1076 ------------------------
> lib/crypto/powerpc/poly1305.h | 76 --
> 4 files changed, 1 insertion(+), 1159 deletions(-)
> delete mode 100644 lib/crypto/powerpc/poly1305-p10le_64.S
> delete mode 100644 lib/crypto/powerpc/poly1305.h
>
Reviewed-by: Ard Biesheuvel <[email protected]>
