Crate polyval[−][src]

Expand description

POLYVAL is a GHASH-like universal hash over GF(2^128) useful for implementing AES-GCM-SIV or AES-GCM/GMAC.

From RFC 8452 Section 3 which defines POLYVAL for use in AES-GCM-SIV:

“POLYVAL, like GHASH (the authenticator in AES-GCM; …), operates in a binary field of size 2^128. The field is defined by the irreducible polynomial x^128 + x^127 + x^126 + x^121 + 1.”

By multiplying (in the finite field sense) a sequence of 128-bit blocks of input data data by a field element H, POLYVAL can be used to authenticate the message sequence as powers (in the finite field sense) of H.

Minimum Supported Rust Version

Rust 1.41 or higher.

In the future the minimum supported Rust version may be changed, but it be will be accompanied with a minor version bump.

Performance Notes

On x86(-64) platforms, set target-cpu in RUSTFLAGS to sandybridge or newer for optimum performance:

Example:

$ RUSTFLAGS="-Ctarget-cpu=sandybridge" cargo bench

Relationship to GHASH

POLYVAL can be thought of as the little endian equivalent of GHASH, which affords it a small performance advantage over GHASH when used on little endian architectures.

It has also been designed so it can also be used to compute GHASH and with it GMAC, the Message Authentication Code (MAC) used by AES-GCM.

From RFC 8452 Appendix A:

“GHASH and POLYVAL both operate in GF(2^128), although with different irreducible polynomials: POLYVAL works modulo x^128 + x^127 + x^126 + x^121 + 1 and GHASH works modulo x^128 + x^7 + x^2 + x + 1. Note that these irreducible polynomials are the ‘reverse’ of each other.”