On Thu, Oct 29, 2026 at 10:42:40AM +0100, Ard Biesheuvel wrote:
> On Thu, 29 Oct 2026, at 07:35, Eric Biggers wrote:
> > The PowerPC implementation of Poly1305 has been marked as BROKEN for
> > well over a year, since commit bc8169003b41 ("crypto: powerpc/poly1305 -
> > add depends on BROKEN for now"). So, it's not being built or used.
> >
> > The justification for marking it BROKEN was that it didn't work in
> > softirq context. That still fully applies.
> >
> > However, it turns out the assembly file actually also contains logic
> > bugs that make it compute incorrect Poly1305 values in some cases. This
> > is shown by it failing the test case test_poly1305_split_update_carry
> > (if "depends on BROKEN" is removed). The cause of that appears to be a
> > lost carry bit in Carry_reduction. However, there also appears to be a
> > bug in do_final_update where it incorrectly assumes v6 is fully reduced.
> >
> > In addition, poly1305_emit_64 contains a secret-dependent branch.
> >
> > Let's just drop this code. A fixed version can be reconsidered later.
> >
> > Signed-off-by: Eric Biggers <[email protected]>
> > ---
> > lib/crypto/Kconfig | 6 +-
> > lib/crypto/Makefile | 2 -
> > lib/crypto/powerpc/poly1305-p10le_64.S | 1076 ------------------------
> > lib/crypto/powerpc/poly1305.h | 76 --
> > 4 files changed, 1 insertion(+), 1159 deletions(-)
> > delete mode 100644 lib/crypto/powerpc/poly1305-p10le_64.S
> > delete mode 100644 lib/crypto/powerpc/poly1305.h
> >
>
> Reviewed-by: Ard Biesheuvel <[email protected]>
Applied to
https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git/log/?h=libcrypto-fixes
- Eric
