[PATCH] poly1305-p10le: fix lost carry in conversion from base 2^26

[Jussi Kivilinna]

* cipher/poly1305-p10le.s (gcry_poly1305_p10le_4blocks): Propagate
carry through second, third and fourth limb before combining limbs
with OR.
--

After final carry reduction, second 26-bit limb may exceed 26 bits.
Combining limbs with OR then loses carry and gives wrong tag for some
inputs, for example when hash is small modulo 2^130-5.

GnuPG-bug-id: 8515
Signed-off-by: Jussi Kivilinna <jussi.kivilinna at iki.fi>
---
 cipher/poly1305-p10le.s | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/cipher/poly1305-p10le.s b/cipher/poly1305-p10le.s
index 133b99a9..5437355a 100644
--- a/cipher/poly1305-p10le.s
+++ b/cipher/poly1305-p10le.s
@@ -758,6 +758,17 @@ loop_4blocks:
 	vaddudm	5, 5, 10
 	vaddudm	8, 8, 11
 
+	# carry v5..v7 so that only v8 can exceed 26 bits
+	vsrd	10, 5, 31
+	vand	5, 5, 25
+	vaddudm	6, 6, 10
+	vsrd	10, 6, 31
+	vand	6, 6, 25
+	vaddudm	7, 7, 10
+	vsrd	10, 7, 31
+	vand	7, 7, 25
+	vaddudm	8, 8, 10
+
 	b	do_final_update
 
 do_final_update:
-- 
2.53.0