Gate CLMUL AES-GCM on SSSE3
It uses PSHUFB. That no one's noticed this across OpenSSL and BoringSSL
suggests very strongly that no x86 CPUs exist with CLMUL and not SSSE3,
but in principle we should check both.
Change-Id: I79242316d2ab793f9f8d2e016d2a80d52fe1afdf
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/77047
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Reviewed-by: Adam Langley <agl@google.com>
diff --git a/crypto/fipsmodule/aes/gcm.cc.inc b/crypto/fipsmodule/aes/gcm.cc.inc
index 87ef5b8..0b9b2ac 100644
--- a/crypto/fipsmodule/aes/gcm.cc.inc
+++ b/crypto/fipsmodule/aes/gcm.cc.inc
@@ -596,7 +596,7 @@
#if defined(OPENSSL_X86) || defined(OPENSSL_X86_64)
int crypto_gcm_clmul_enabled(void) {
#if defined(GHASH_ASM_X86) || defined(GHASH_ASM_X86_64)
- return CRYPTO_is_PCLMUL_capable();
+ return CRYPTO_is_PCLMUL_capable() && CRYPTO_is_SSSE3_capable();
#else
return 0;
#endif
