Expand description
Binary field implementation of GF(2^256) as a degree-two extension of the GHASH field.
Elements are pairs (a, b) representing a + b·Y, where a and b are elements of
Ghash128b. The extension is defined by the irreducible polynomial
Y² + X·Y + X over GHASH, so that Y² = X·Y + X.
The field is backed by M256, with the low 128 bits holding the coefficient of 1 (a) and
the high 128 bits holding the coefficient of Y (b). This is the same layout as
PackedGhash2x128b (two GHASH lanes in an M256) and
matches the {1, Y} basis used by the ExtensionField<Ghash128b> implementation.
Reducing with Y² = X·Y + X multiplies by X (a left shift) rather than by X⁻¹, and the
multiply-by-X folds into the reduction. Multiplication batches the two GHASH products that
share the AVX2 256-bit CLMUL into a single
PackedGhash2x128b multiply (the mul_m256i_hybrid
algorithm).