AES T-table lookups are data-dependent leaking key material via cache timing (CCMP always dm-crypt/IPsec on non-AES-NI)

Summary

Every round of rijndaelEncrypt/rijndaelDecrypt performs four table lookups per output word whose indices are byte slices of secret-dependent state (e.g. Te0[s0>>24]). Te0..Te3/Td0..Td3 are 1KB each (256x u32) so whether a given line is resident in data cache depends on key-derived index. Co-resident local process recovers AES key bytes via Prime+Probe/Flush+Reload cache-timing. Tables are read-only static const shared across all callers cache-resident (worst case for attacker). wlan_ccmp invokes rijndael_encrypt unconditionally per frame (no AES-NI bypass) so WPA2-CCMP always vulnerable. cryptoapi software fallback used by dm-crypt when AES-NI absent/disabled.