nx_ghash.nx

buildroot/runtime/nx_ghash.nx

9283 B231 linesdepth 3pulls 3 transitivereach 595 importersview sourcekind tooltopic ghash

docs dependencies structs consts functions

about

nx_ghash.nx -- GF(2^128) multiplication and GHASH accumulator. Per NIST SP 800-38D Algorithm 1. Used as the authentication tag engine inside AES-GCM (RFC 5288 / RFC 8446 §5.3 for TLS 1.3 AES-128-GCM cipher suite). Bit convention (SP 800-38D §6.1, "MSB-first" within each byte): - bytes are streamed left to right - bit 0 of byte 0 is the MSB of the GF element - reduction polynomial R = 11100001 || 0^120 (byte[0] = 0xe1) Public API: nx_ghash_mul(x16, h16, z16) z = x * h (16-byte buffers) nx_ghash_update_block(y16, h16, x16) y = (y XOR x) * h nx_ghash_update_buf(y16, h16, buf, len) zero-pad-to-16 + accumulate nx_ghash_finalize(y16, h16, aad_len, ct_len, tag16) append 16-byte length block + final XOR with E_K(J0) is the CALLER's responsibility (it has the AES key); ghash produces the raw S = GHASH(AAD || CT || lenblk). Per the bit-level no-proliferation cardinal: this is the substrate's CANONICAL GF(2^128) implementation. AES-GCM seal/open compose THIS file's primitives -- they MUST NOT re-implement _ghash_mul inline. Future hardware-accelerated variants (CLMUL on x86, PMULL on aarch64) ship as alternative backends behind the same API surface. license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/nist/sp_800_38d lineage_id: nishi_ghash_q10

dependencies 2 imports · 5 importers

imports: nx_syscalls.nxnx_ghash_clmul.nx

imported by: nx_aes128_gcm.nxnx_aes256_gcm.nxnx_ghash_bench.nxnx_ghash_clmul_gate.nxnx_ghash_kat_test.nx

structs

none

consts

none

functions

51	func nx_ghash_mul(x16: u8, h16: u8, z16: *u8) -> i64 called by 1: nx_ghash_update_block calls 1: nx_ghash_mul_clmul
56	func nx_ghash_mul_bitwise(x16: u8, h16: u8, z16: *u8) -> i64 called by 2: main check calls 1: sys_mmap
88	func gh_upd_temp() -> *u8 called by 1: nx_ghash_update_block calls 1: sys_mmap
94	func nx_ghash_update_block(y16: u8, h16: u8, x16: *u8) -> i64 called by 2: nx_ghash_update_buf nx_ghash_finalize calls 2: gh_upd_temp nx_ghash_mul
110	func nx_ghash_reflect16(dst: u8, src: u8) -> i64 called by 1: nx_aes128_gcm_seal calls 1: gh_byterev_bits
117	func gh_rev_scratch() -> *u8 called by 1: nx_ghash_upd_rev calls 1: sys_mmap
126	func nx_ghash_upd_rev(py: u8, rh: u8, x16: *u8) -> i64 called by 1: nx_aes128_gcm_seal calls 3: gh_rev_scratch gh_byterev_bits gh_clmul_core
142	func nx_ghash_mul_rev(a16: u8, b16: u8, out16: *u8) -> i64 called by 1: nx_aes128_gcm_seal calls 1: gh_clmul_core
149	func gh_agg_scratch() -> *u8 called by 1: nx_ghash_upd_rev4 calls 1: sys_mmap
159	func nx_ghash_upd_rev4(py: u8, rh1: u8, rh2: u8, rh3: u8, rh4: u8, blocks: u8) -> i64 called by 1: nx_aes128_gcm_seal calls 4: gh_agg_scratch gh_byterev_bits gh_clmul_mul256_acc gh_clmul_reduce256
187	func nx_ghash_update_buf(y16: u8, h16: u8, called by 4: nx_aes128_gcm_open nx_aes256_gcm_seal nx_aes256_gcm_open main calls 2: sys_mmap nx_ghash_update_block
205	func nx_ghash_be64_put(dst: *u8, v: i64) -> i64 called by 2: nx_aes128_gcm_seal nx_ghash_finalize
220	func nx_ghash_finalize(y16: u8, h16: u8, called by 4: nx_aes128_gcm_open nx_aes256_gcm_seal nx_aes256_gcm_open main calls 3: sys_mmap nx_ghash_be64_put nx_ghash_update_block
229	func main() -> i64