5f614d74a9
AliroGcm: replace bit-by-bit gfMul with 4-bit Shoup-style multiplication. Adds a 16-entry M-table (256 B transient) built per-encrypt from H, plus fixed L_BYTE0/L_BYTE1 reduction lookups (32 B EEPROM). Inner loop drops from 128 conditional bit ops to 32 nibble lookups + a single 4-bit shift. Measured 2.3x GHASH speedup on j3r452 (5,368 -> 2,336 ms per AUTH1 GCM) and a 1.78x AUTH1 wall-clock speedup (5,795 -> 3,244 ms). All 80 unit tests pass; NIST GCM TC13/14/15 vectors produce byte-identical output. Also adds runtime probes for native HMAC-SHA-256 (AliroHmac) and native AES-CTR (AliroGcm, currently disabled). Both run a full smoke test in the constructor (buildKey + setKey + init + sign/doFinal) and fall back to userland silently if any step throws. JCAlgTest reports both as supported on j3r452 but only at the getInstance/buildKey level; setKey throws ILLEGAL_VALUE end-to-end -- the smoke test catches this so we never call the broken native path. Native CTR's real-encrypt hang is unrelated to the smoke test and is left disabled pending isolation. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>