org.bouncycastle.math.raw

Class GF256AES

java.lang.Object

org.bouncycastle.math.raw.GF256AES

public class GF256AES
extends java.lang.Object

Constant-time GF(2^8) primitives over the AES reduction polynomial x^8 + x^4 + x^3 + x + 1 (0x11b).

The AES suffix names that specific irreducible polynomial: GF(2^8) is a single field up to isomorphism but admits many representations, and the AES choice is by far the most common (also used by SM4, GHASH's sibling fields, etc.). The polynomial alone pins down the arithmetic — e.g. Rainbow's GF(2^8) uses a tower basis whose products differ, so it deliberately does not share this class. Callers relying on the AES element encoding should depend on the name, not just "GF(256)".

Shared home for the word-parallel bitsliced scalar-times-vector multiply used by the multivariate / MPC-in-the-head schemes (SDitH, UOV, ...). Companion to GF16 for the GF(2^4) nibble field.

Method Summary

Modifier and Type	Method and Description
static int	inv(int a) Constant-time GF(256) multiplicative inverse over 0x11b via the Fermat addition chain a^254 = a^-1 (since a^255 = 1 for nonzero a).
static int	mul(int a, int b) Constant-time GF(256) scalar multiply over the AES polynomial 0x11b: returns a * b.
static long	mulFx8(int s, long v) Word-parallel constant-time GF(256) scalar-times-vector multiply: returns s * v where v packs eight GF(256) elements, one per byte lane, and the result packs the eight products in the same lanes.
static int	sqr(int a) Constant-time GF(256) squaring over 0x11b.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

mul

public static int mul(int a,
                      int b)

Constant-time GF(256) scalar multiply over the AES polynomial 0x11b: returns a * b. There is no table lookup and no data-dependent branch — safe to feed secret operands. This is the scalar companion of mulFx8(int, long) and is byte-identical to the per-scheme forms it replaces (UOV's mul256, SDitH's mulNaive, MQOM's gf256Mult).

sqr

public static int sqr(int a)

Constant-time GF(256) squaring over 0x11b. Squaring is GF(2)-linear, so a^2 is just the bit-spread of a (interleave a zero between each bit), reduced mod 0x11b.

inv

public static int inv(int a)

Constant-time GF(256) multiplicative inverse over 0x11b via the Fermat addition chain a^254 = a^-1 (since a^255 = 1 for nonzero a). The chain maps 0 -> 0, so no data-dependent zero check is needed and none is done: branching on zero-ness would leak whether a (secret-derived) value was singular. No table is used. The seven squarings go through the dedicated sqr(int); the four genuine products through mul(int, int).

mulFx8

public static long mulFx8(int s,
                          long v)

Word-parallel constant-time GF(256) scalar-times-vector multiply: returns s * v where v packs eight GF(256) elements, one per byte lane, and the result packs the eight products in the same lanes.

Algorithm: s*v = XOR_k s_k (x^k . v) over the 8 bits s_k of the scalar, where x^k . v is k-fold GF(256) doubling (xtime) of every lane. xtime is the branchless SWAR step ((v<<1) & 0xFE..) ^ ((v>>>7 & 0x01..) * 0x1b), and each scalar bit selects via the mask -(s_k) (0 or -1). No table and no data-dependent branch, so it is safe to feed secret scalars (the operand of a secret-share multiply-accumulate).