[dgarske]

Description

Two AES changes that came out of benchmarking wolfCrypt on a RISC-V rv64gc core (PolarFire SoC Video Kit, SiFive U54, Linux):

• WOLFSSL_AES_NO_TOUCH_LINES clears the WOLFSSL_AES_TOUCH_LINES default that wolfcrypt/src/aes.c applies to every __riscv build, without the rest of WC_NO_CACHE_RESISTANT. Before, the only way off the per-lookup table scan was --disable-harden, which also drops timing resistance and blinding; the scan makes the C AES modes far slower than the plain T-table code the RISC-V assembly tier already uses. An explicit WOLFSSL_AES_TOUCH_LINES still wins.
• configure: --enable-aes-touch-lines=yes|no. The default leaves aes.c's choice alone; the value is shown in the configure summary.
• cmake: WOLFSSL_AES_TOUCH_LINES=default|yes|no. default leaves aes.c's choice alone, so a -DWC_NO_CACHE_RESISTANT in CMAKE_C_FLAGS keeps working; yes and no emit their macro whatever CMAKE_SYSTEM_PROCESSOR says. Both macros are in options.h.in.
• doc/ALGORITHM_DEFINES.md documents the new define next to WOLFSSL_AES_TOUCH_LINES.
• bench_aesxts now times AES-256-XTS as well as AES-128-XTS. The per-key body is a static bench_aesxts_key() taking the key, its length and the result labels; bench_aesxts() calls it under WOLFSSL_AES_128 with a 32-byte key and under WOLFSSL_AES_256 with a 64-byte key. The result lines are AES-128-XTS-enc/-dec and AES-256-XTS-enc/-dec (plus the -stream- variants with WOLFSSL_AESXTS_STREAM), so anything parsing the old AES-XTS-enc label needs the new names.

Testing

Checked by configuring with autotools and cmake on x86-64 and with a riscv64 cross compiler for default, yes and no, and by preprocessing aes.c on riscv64 to confirm the macro is set only when intended. The benchmark change ran on the Video Kit with both the C and the --enable-riscv-asm builds and on a host --enable-aesxts build; the new configure option was not benchmarked on hardware.

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,576 B (+0.6%, 284,024 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The CMake logic can override WC_NO_CACHE_RESISTANT on RISC-V and ignore an explicit touch-lines opt-out when the processor string is missing or unrecognized, causing unwanted per-lookup table scans.

2 open issues

• Default CMake setting overrides WC_NO_CACHE_RESISTANT · New
• Explicit no fails to disable touch-lines with unmatched processor name · New

What changed in this PR

Adds targeted control over AES cache-line touching in wolfCrypt and extends XTS benchmarking to cover AES-256 alongside AES-128.

Changes:

• Introduces WOLFSSL_AES_NO_TOUCH_LINES to disable the RISC-V default without disabling other hardening.
• Adds Autotools and CMake controls, generated-header definitions, and documentation.
• Shares the XTS benchmark implementation across key sizes and adds key-size-specific result labels.

File	Description
wolfcrypt/​src/​aes.c	Honors the opt-out macro when applying the RISC-V default.
wolfcrypt/​benchmark/​benchmark.c	Adds AES-256-XTS benchmarks and distinct result labels.
doc/​ALGORITHM_DEFINES.md	Documents the new opt-out macro.
configure.ac	Adds the touch-lines option and configure summary output.
CMakeLists.txt	Adds the touch-lines option and macro selection.
cmake/​options.h.in	Exports both touch-lines macros in the generated header.

_{Review effort: Balanced}

[SparkiDev]

Jenkins: retest this please

[SparkiDev]

Static memory google test failing.
Nothing to do with this PR.