Re: [Cfrg] Comments on side channel draft

[Manuel Pégourié-Gonnard <[e-mail]>]

On 08/01/2014 01:21, Watson Ladd wrote:
> Blinding is my second choice compared to constant time. The reason is
> that blinding might not work perfectly, whereas circuit-like programs have
> no timing sidechannels by definition.
> 
Maybe the draft should go into more details about he possible shortcomings of
blinding then.

I feel like, for existing implementations, it's often easier to add blinding at
some well-chosen places than to rewrite their whole arithmetic from scratch to
be constant-time. So, used properly, it can be an interesting way to gradually
enhance the resistance of existing implementations.

> The problem is that one really cannot tell what does and does not contain
> jumps without looking at the assembler output.

Agreed. However, there seems to be ways to code things that are commonly
accepted as producing no hidden branches on common platforms with common compilers.

> Mix in the different compilers, architectures, and compiler options, and
> this is far, far too much work for me to reasonably do.
> 
Sure, but by the same reasoning it's too much work for any implementer wanting
to write portable code (so that assembly isn't an option). IMO this is precisely
in such situations that it is useful to share the collective knowledge of the
CFRG in a document that can then be relied upon by others, even if it's not
exhaustive.

If providing reliable solutions is too hard, then at least the draft could warn
about constructs that may look constant-time but are actually not of some common
platforms. Examples could include integer division (see below), and the "hidden
branch in 'c = (a == b)'" issue if it's still an issue with common compilers on
common platforms.

> Even integer division is not constant time on some CPU families.
> 
Well, it's not just some exotic CPUs, it includes common Intel, AMD, ARM and Via
CPUs at least, according to [1] (which focuses on floating point but also tests
integer operation).

[1]: https://wiki.mozilla.org/User:Bjacob/ArithmeticTimingDifferences

Manuel.