Module ghash_sq 

Packed GhashSq256b in two layouts: sliced (struct-of-arrays) and interleaved (array-of-structs).

GhashSq256b is the degree-two extension a + b·Y of the GHASH field, with Y² = X·Y + X. Both layouts reduce a batch multiply to three packed GHASH multiplies (Karatsuba over Y) rather than a schoolbook product per element, and both defer the GHASH reductions and the multiply-by-X — all GF(2)-linear — so an inner product reduces once at the end.

• The sliced packings (SlicedGhashSq256b) store the a and b coordinates of every lane in two separate packed GHASH registers via SlicedPackedField; Mul and the rest of the PackedField surface come generically from SlicedPackedField.
• The interleaved packings (PackedGhashSq1x256b / PackedGhashSq2x256b, i.e. PackedPrimitiveType<M256/M512, GhashSq256b>) store each scalar as one contiguous 256-bit value — the same layout as the scalar field. The width-one packing carries the field arithmetic (and the scalar GhashSq256b derives its own from it), while the width-two packing divides into two width-one lanes.

In both, the coordinate register is a PackedPrimitiveType, so the multiply-by-X in the reduction is a bit shift over the register rather than a full field multiply.

The width-one packing’s widening multiply is architecture-specific — see GhashSqWideMul1x, which selects between batching the Karatsuba diagonal into one 256-bit carry-less multiply and keeping the three products separate to defer the multiply-by-X past a reduction.

Structs

GhashSqInvert

InvertOrZero strategy for PackedGhashSq1x256b.

GhashSqSquare

Square strategy for PackedGhashSq1x256b.

SlicedGhashSqWide

The unreduced product of two GHASH² elements, as three separate GHASH products.

Type Aliases

PackedGhashSq1x256b

PackedGhashSq2x256b

SlicedGhashSq1x256b

Packed GhashSq256b holding one extension scalar (the degenerate width-one packing).

SlicedGhashSq2x256b

Packed GhashSq256b holding two extension scalars.

SlicedGhashSq4x256b

Packed GhashSq256b holding four extension scalars.

SlicedGhashSq256b

A GHASH² packing whose two GHASH coordinates pack into PackedPrimitiveType<U, Ghash128b>.