CLMUL

Carry-less multiplication (CLMUL) refers to a form of multiplication performed over the finite field GF(2), where binary operands are treated as polynomials and multiplication is done without carries. This yields a result that corresponds to polynomial multiplication, with up to twice the width of the operands in bits. CLMUL is designed for hardware acceleration and is used to speed up cryptographic and error-detection algorithms that rely on binary polynomial arithmetic.

In x86 processors, the primary instruction is PCLMULQDQ (carry-less multiply of 128-bit operands), producing a 256-bit product. It is used to implement fast GF(2^128) multiplications, essential for the GHASH operation in AES-GCM. In ARM architectures, the PMULL instruction performs 64x64 carry-less multiplication and is part of the Crypto Extensions. These instructions are typically combined with a reduction step modulo a fixed irreducible polynomial to operate in a chosen finite field.

Applications include accelerating the GHASH component of AES-GCM, where efficient polynomial multiplication in GF(2^128) improves authentication throughput. CLMUL can also accelerate other cryptographic algorithms and integrity checks that rely on binary polynomial arithmetic, as well as certain CRC computations when implemented via GF(2) methods. The technology is widely used in conjunction with other crypto acceleration features, such as AES-NI on x86, to provide end-to-end performance benefits for modern cryptographic workloads.

Software support for CLMUL is provided through compiler intrinsics and optimized libraries. Crypto libraries (for example, OpenSSL) implement paths that leverage CLMUL to speed up GCM and related operations, enabling faster authenticated encryption in diverse environments.