From: Mark Wooding <mdw@distorted.org.uk>
Date: Tue, 16 Jan 2024 13:36:33 +0000 (+0000)
Subject: utils/gcm-ref (poly64_mul_simple): Pad v based on the length of v.
X-Git-Url: https://git.distorted.org.uk/~mdw/catacomb/commitdiff_plain/1dfa221e51f3c5cae10eac71657f4ad1dbc4d91c

utils/gcm-ref (poly64_mul_simple): Pad v based on the length of v.

Not the already-padded length of u, which doesn't make any sense.  Now
we actually calculate 96-bit products correctly using the `poly64'
multiplication machinery.
---

diff --git a/utils/gcm-ref b/utils/gcm-ref
index ec25bb8d..03672412 100755
--- a/utils/gcm-ref
+++ b/utils/gcm-ref
@@ -281,7 +281,7 @@ def poly64_mul_simple(u, v, presfn, wd, dispwd, mulwd, uwhat, vwhat):
   ## straightforward except for the 96-bit case, where we end up with two
   ## short pieces which we pad at the beginning.
   if uw%mulwd: pad = (-uw)%mulwd; u += C.ByteString.zero(pad); uw += pad
-  if vw%mulwd: pad = (-uw)%mulwd; v += C.ByteString.zero(pad); vw += pad
+  if vw%mulwd: pad = (-vw)%mulwd; v += C.ByteString.zero(pad); vw += pad
   uu = split_gf(u, mulwd)
   vv = split_gf(v, mulwd)