Re: [Cfrg] questions on performance and side channel resistance for ChaCha20 and Poly1305 for IPsec and TLS

[David McGrew <[e-mail]>]

Hi Robert,

On 01/23/2014 01:26 PM, Robert Ransom wrote:
> On 1/23/14, David McGrew <[e-mail]> wrote:
>
>> Another goal for this ciphersuite is to avoid side channel attacks,
>> though it is not directly mentioned in the draft.    The design
>> rationale for Salsa describes how timing channels are avoided by not
>> using multiplication in that function.   However, Poly1305 uses *lots*
>> of multiplication operations, by a fixed constant.  Unless I am missing
>> something, this is an inconsistency with the motivation for the
>> ciphersuite.  In any case, if Poly1305 requires implementation
>> techniques to avoid side channels, they should be documented in the
>> draft that specifies that function.
> Dr. Bernstein's original implementation of Poly1305 used the IA-32
> floating-point unit to avoid timing leaks on the processors available
> in 2005.  My understanding is that essentially all modern processors
> have constant-time integer multipliers, so special implementation
> techniques are no longer required.

this would be great news.   The issue does deserve to be documented, 
though, even if we can cite a study that shows that current processors 
don't have the issue, since future processors might behave differently.

thanks,

David

>
>
> Robert Ransom
> .
>