Module ghash_sq 

Portable GHASH² widening multiply: three independent GHASH multiplies over the coordinates.

This is the strategy for targets whose widest carry-less multiply is 128 bits, where batching the Karatsuba diagonal into a two-lane packed GHASH multiply buys nothing — that packed multiply decomposes back into two independent 128-bit multiplies, each with its own reduction. Keeping the three Karatsuba products separate instead lets the multiply-by-X of the irreducible polynomial be applied to an unreduced product (MulXWide), which folds it into a reduction that has to happen anyway: two GHASH reductions per GHASH² product rather than three.

Structs

GhashSqSlicedWideMul

WideMul strategy for PackedGhashSq1x256b keeping the three Karatsuba products of the coordinate multiply separate, so that the multiply-by-X can be deferred into a reduction.