nx_ghash_clmul.nx

nx_ghash_clmul.nx -- hardware PCLMULQDQ backend for GF(2^128) multiply (GHASH core). Byte-IDENTICAL drop-in for nx_ghash.nx's nx_ghash_mul, ~hardware speed vs the ~1 MB/s bit-by-bit reference. Gated against that reference as the oracle (KAT-equality). Bridge from GCM's bit convention to PCLMULQDQ: GCM (SP 800-38D) stores coeff(x^i) MSB-FIRST: byte (i>>3), bit position (7-(i&7)). PCLMULQDQ multiplies polynomials where integer-bit k = coeff(x^k) (LSB-first). A BYTEWISE bit-reversal (reverse the 8 bits WITHIN each byte; byte order unchanged) maps GCM coeff(x^k) onto little-endian integer-bit k -- exactly pclmulqdq's input. So: bitrev each input -> 4 clmuls (schoolbook 128x128 -> 256) -> reduce mod P(x)=x^128+x^7+x^2+x+1 -> bitrev the 128-bit result back to GCM byte order. The reduction uses x^128 = x^7+x^2+x+1 (mod P): fold the high 128 bits H by H*(x^7+x^2+x+1) (two folds -- the first leaves <=7 overflow bits past bit 127, the second clears them). NishiLang `>>` is ARITHMETIC, so gh_lshr() masks to emulate a logical shift. license_tier: ORIGINAL (composes nx_ghash.nx conventions; new CLMUL lowering) genealogy_id: international-research-sources/intel/clmul-gcm lineage_id: nishi_ghash_clmul_q1