Poly Versus Polyval

What it is

"Poly Versus Polyval" is a preprint (ePrint 2026/2707, received 31 October 2026) by Kaushik Nath and Palash Sarkar. It compares two polynomial-evaluation hash functions over GF(2^n) with n = 64k and k ≥ 2: Poly, which uses ordinary reduction, and Polyval, which uses Montgomery reduction.

How it works

Poly differs from GHASH, the NIST standard for n = 128, in one respect: it skips the bit reversal of each n-bit block. The authors say this makes it faster than GHASH. Polyval is already a faster alternative to GHASH, and the paper's question is whether Poly beats Polyval.

The authors choose field-defining irreducible polynomials that make both ordinary and Montgomery reduction efficient. They give algorithms for each reduction with correctness proofs. They also report assembly implementations of both hashes for n = 128, 256 and 512.

What to do

The abstract gives this selection rule:

• For n = 128, Polyval is faster than Poly.
• For n = 256 and 512, and for larger n, Poly is faster than Polyval.

The authors tie the 128-bit and 256-bit cases to the NIST process for cryptographic accordions. Anyone building a wide-block construction there should read the paper's reduction choices and its field polynomials.

Caveats

The abstract gives no cycle counts, target CPUs or instruction-set details, so the size of the speed gaps is unknown without the full text. The paper is a preprint and has not been peer reviewed.