Comment on ChaCha20- and Poly1305-based Cipher Suites for TLSparentComments−sweis12yOpenSSL has a GCM implementation which is very fast and I believe is not susceptible to timing attacks due to using vpclmulqdq: http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=crypto...You can debate whether it's a "software implementation" since it's using AESNI and PCLMULQDQ.−tptacek12yI think PCLMULQDQ is noncontroversial, but also considered "hardware supported".
Comments
OpenSSL has a GCM implementation which is very fast and I believe is not susceptible to timing attacks due to using vpclmulqdq: http://git.openssl.org/gitweb/?p=openssl.git;a=blob;f=crypto...
You can debate whether it's a "software implementation" since it's using AESNI and PCLMULQDQ.
I think PCLMULQDQ is noncontroversial, but also considered "hardware supported".