Is it possible to use bitslicing for GCM? This seems like a way to allow for a way to avoid cache-timing attacks without PCLMUL instructions and with good performance.
$\begingroup$
$\endgroup$
-
1$\begingroup$ You can check Faster and Timing-Attack Resistant AES-GCM by Emilia et al. $\endgroup$ – Makif May 20 '16 at 12:42
