tree dafedc1d4eb6c07654c401a87cc43e18ea93559d
parent 7ea01b70ecaef7bbee3c0b530a444baeb213673d
author Pirmin Vogel <vogelpi@lowrisc.org> 1618398260 +0200
committer Pirmin Vogel <vogelpi@lowrisc.org> 1618472764 +0200

[aes] Clarify that the use both masked Canright S-Boxes is discouraged

It is widely known that both these S-Boxes suffer from SCA leakage, they
cannot be made to pass formal analysis in transient mode. This commit
corrects comments around this fact and makes clear that they are
included just for reference.

Signed-off-by: Pirmin Vogel <vogelpi@lowrisc.org>