Re: [Cfrg] Point format endian (was: Adoption of draft-ladd-spake2 as a RG document)

[Michael Clark <[e-mail]>]

On 26/1/15 8:57 pm, Michael Clark wrote:
> Someone starting today would indicate endianness statically or
> dyanamically in their number format and use the hot potato principle.
> Get it off your hands at the lowest cost to yourself, which nowadays is
> little-endian. Remember GHASH is Bit Reflected (base 2 little endian)
> and it made it into a spec.

Just saw DJB's email on twitter.

https://www.ietf.org/mail-archive/web/cfrg/current/msg05938.html

Wrote this last night before seeing it:

I believe GCM GHASH is bit-reflected (more accurately bit level little
endian, the true opposite to big-endian or "true little endian") on the
wire in the GCM AEAD hash. It is an existing example of not using
big-endian, but also not using little-endian as we commonly know it
(bignums: with 8-bit big endian limbs, little limb first).

The finite field bit set for GHASH could potentially be represented in
either big-endian or little-endian. e.g. where the bit offsets [0-127]
are within either of those domains, but it is neither. It is perhaps
better called "true little-endian or base 2 little-endian".

Just citing this as precedence for a 16-octet opaque encoding of a
galois field value that is not big-endian and is used in TLS, SSH, etc.

That said, GHASH is really a GF(2^n) bit set, and not a scalar.

The fact that GHASH only uses xor and shifts makes it different to
scalarmult, however the Intel PCLMULQDQ GHASH implementation needs to
deal with this bit-reflection property in AES-GCM as the PCLMULQDQ
instruction shifts "left", not "right" as you would typically do for
GHASH. It seems to cause extra work for computers with little-endian
bignums and 8-bit big endian limbs, little 8-bit limb first.
litte-endian as we know it is a misnomer and GHASH is perhaps "true
little-endian". GCM is an example of making computers work even harder
using an even more obscure encoding.

If you want to break a tradition; it pays to have a counter example
where it has already been broken (and made things harder).

You have to consciously decide to "not do extra work" on most computers
or maintain tradition. le wire format still needs bswaps for portable
code: just they will be compiled out on prevalent systems "today" versus
mid-to-late-90's.

Ref:
{Carry-Less Multiplication and Its Usage for Computing the GCM Mode}