Crate polyval

POLYVAL is a GHASH-like universal hash over GF(2^128) useful for implementing AES-GCM-SIV or AES-GCM/GMAC.

From RFC 8452 Section 3 which defines POLYVAL for use in AES-GCM_SIV:

"POLYVAL, like GHASH (the authenticator in AES-GCM; ...), operates in a binary field of size 2^128. The field is defined by the irreducible polynomial x^128 + x^127 + x^126 + x^121 + 1."

By multiplying (in the finite field sense) a sequence of 128-bit blocks of input data data by a field element H, POLYVAL can be used to authenticate the message sequence as powers (in the finite field sense) of H.

Requirements

• Rust 1.32.0 or newer
• RUSTFLAGS with -Ctarget-cpu and -Ctarget-feature:
  • x86(-64) CPU: target-cpu=sandybridge or newer
  • SSE2 + SSE4.1: target-feature=+sse2,+sse4.1

An INSECURE (variable timing) portable implementation is gated behind the insecure-soft cargo feature. Use of this implementation is NOT RECOMMENDED and may potentially leak the POLYVAL key!

Relationship to GHASH

POLYVAL can be thought of as the little endian equivalent of GHASH, which affords it a small performance advantage over GHASH when used on little endian architectures.

It has also been designed so it can also be used to compute GHASH and with it GMAC, the Message Authentication Code (MAC) used by AES-GCM.

From RFC 8452 Appendix A:

"GHASH and POLYVAL both operate in GF(2^128), although with different irreducible polynomials: POLYVAL works modulo x^128 + x^127 + x^126 + x^121 + 1 and GHASH works modulo x^128 + x^7 + x^2 + x + 1. Note that these irreducible polynomials are the 'reverse' of each other."

Re-exports

pub extern crate subtle;

pub use self::tag::Tag;

Modules

field	Implementation of POLYVAL's finite field.
tag	POLYVAL authentication tags

Structs

Polyval

POLYVAL: GHASH-like universal hash over GF(2^128).

Constants

BLOCK_SIZE

Size of a POLYVAL block (128-bits)

Type Definitions

Block

POLYVAL blocks (16-bytes)