Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS

[Robert Ransom <[e-mail]>]

On 1/23/14, David McGrew <[e-mail]> wrote:

> Another goal for this ciphersuite is to avoid side channel attacks,
> though it is not directly mentioned in the draft.    The design
> rationale for Salsa describes how timing channels are avoided by not
> using multiplication in that function.   However, Poly1305 uses *lots*
> of multiplication operations, by a fixed constant.  Unless I am missing
> something, this is an inconsistency with the motivation for the
> ciphersuite.  In any case, if Poly1305 requires implementation
> techniques to avoid side channels, they should be documented in the
> draft that specifies that function.

Dr. Bernstein's original implementation of Poly1305 used the IA-32
floating-point unit to avoid timing leaks on the processors available
in 2005.  My understanding is that essentially all modern processors
have constant-time integer multipliers, so special implementation
techniques are no longer required.


Robert Ransom