Merged PR 15511162: Temporarily disable AES-GCM ZMM implementation for v103.12.0

We need to backport the new composite ML-KEM and composite ML-DSA releases into servicing branches, but we don't want to backport the AES-GCM ZMM implementation yet as it hasn't had enough bake time. This change temporarily disables the implementation for v103.12.0.

Author: mlindgren

CHANGELOG.md

@@ -2,17 +2,15 @@
 New changes will be listed here as they are developed. The version number is determined
 prior to the creation of a new release, based on the changes contained in that release.
 
-- Added `SymCryptModuleInitEx` function and `SYMCRYPT_MODULE_INIT_EX` macro. Unlike `SymCryptModuleInit` which calls `SymCryptFatal` on version mismatch, `SymCryptModuleInitEx` returns `SYMCRYPT_INVALID_ARGUMENT`, allowing callers to handle the error gracefully.
-- Removed enforcement of minimum hash collision strength for HashML-DSA. Per PQC forum discussions, FIPS 204 recommends that hash algorithms used in HashML-DSA should provide collision resistance at least equal to lambda, but this is a recommendation to the caller, not a requirement for the implementation.
-
 # Version 103.12.0
 
-- Add ZMM (AVX512) implementation of AES-GCM: improves performance by up to 35% on supported hardware
 - Add loop bounds to ML-DSA functions which use probabilistic sampling, as defense-in-depth against denial of service by maliciously formed keys
   - There is no known vulnerability associated with this, but adding upper bounds provides additional hardening
   - Also fixes [#55](https://github.com/microsoft/SymCrypt/issues/55); thanks to Sunwoo Lee and Seunghyun Yoon, Korea Institute of Energy Technology (KENTECH) for filing this issue
 - Add Elevated Debugger environment
 - Add Composite ML-DSA implementation
+- Added `SymCryptModuleInitEx` function and `SYMCRYPT_MODULE_INIT_EX` macro. Unlike `SymCryptModuleInit` which calls `SymCryptFatal` on version mismatch, `SymCryptModuleInitEx` returns `SYMCRYPT_INVALID_ARGUMENT`, allowing callers to handle the error gracefully.
+- Removed enforcement of minimum hash collision strength for HashML-DSA. Per PQC forum discussions, FIPS 204 recommends that hash algorithms used in HashML-DSA should provide collision resistance at least equal to lambda, but this is a recommendation to the caller, not a requirement for the implementation.
 
 # Version 103.11.0
 

lib/aes-default.c

@@ -507,6 +507,7 @@ SymCryptAesGcmEncryptPartOnePass(
         SYMCRYPT_ASSERT( pState->pKey->pBlockCipher->blockSize == SYMCRYPT_GCM_BLOCK_SIZE );
 
 #if SYMCRYPT_CPU_AMD64
+        #if 0 // AES-GCM ZMM temporarily disabled for backport
         // We use SYMCRYPT_CPU_FEATURE_SAVEZMM_NOFAIL to exclude kernel mode, where the use of ZMM
         // registers has historically caused problems. We still call SaveZmm/RestoreZmm and
         // gracefully fall back if it fails.
@@ -523,7 +524,9 @@ SymCryptAesGcmEncryptPartOnePass(
                 bytesToProcess );
 
             SymCryptRestoreZmm( &SaveData );
-        } else if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURES_FOR_VAES_256_CODE ) &&
+        } else 
+        #endif // AES-GCM ZMM disabled
+        if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURES_FOR_VAES_256_CODE ) &&
             (bytesToProcess >= GCM_YMM_MINBLOCKS * SYMCRYPT_GCM_BLOCK_SIZE) &&
             SymCryptSaveYmm( &SaveData ) == SYMCRYPT_NO_ERROR )
         {
@@ -684,6 +687,7 @@ SymCryptAesGcmDecryptPartOnePass(
         SYMCRYPT_ASSERT( pState->pKey->pBlockCipher->blockSize == SYMCRYPT_GCM_BLOCK_SIZE );
 
 #if SYMCRYPT_CPU_AMD64
+        #if 0 // AES-GCM ZMM temporarily disabled for backport
         // We use SYMCRYPT_CPU_FEATURE_SAVEZMM_NOFAIL to exclude kernel mode, where the use of ZMM
         // registers has historically caused problems. We still call SaveZmm/RestoreZmm and
         // gracefully fall back if it fails.
@@ -700,7 +704,9 @@ SymCryptAesGcmDecryptPartOnePass(
                 bytesToProcess );
 
             SymCryptRestoreZmm( &SaveData );
-        } else if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURES_FOR_VAES_256_CODE ) &&
+        } else 
+        #endif // AES-GCM ZMM disabled
+        if( SYMCRYPT_CPU_FEATURES_PRESENT( SYMCRYPT_CPU_FEATURES_FOR_VAES_256_CODE ) &&
             (bytesToProcess >= GCM_YMM_MINBLOCKS * SYMCRYPT_GCM_BLOCK_SIZE) &&
             SymCryptSaveYmm( &SaveData ) == SYMCRYPT_NO_ERROR )
         {