[P1619-2] Future Intel GCM instructions

[Hal Finney <hal.finney@xxxxxxxxx>]

Here is an article about the future extension to the Intel instruction
set to help with computing Galois field "carry-less" multiplication:

http://softwarecommunity.intel.com/articles/eng/3787.htm (also
http://softwarecommunity.intel.com/isn/downloads/intelavx/Carry-Less-Multiplication-and-The-GCM-Mode_WP%20.pdf
)

The new PCMULQDQ instruction uses little-endian ordering for the bits
within a byte, while GCM uses big-endian ordering, as does our XCB
mode. However in the section "Bit Reflection Peculiarity of GCM ", the
article shows that this difference can be accommodated by a few simple
shift operations.

EME2 uses the little-endian ordering, but does not actually do field
multiplications, just shifts, so these enhancements would not be
helpful for that mode.

(Also of note, the new AES instructions for greater speed and reduced
side channel attacks:
http://softwarecommunity.intel.com/articles/eng/3788.htm )

Hal Finney
PGP Corporation