Re: [TLS] Using Brainpool curves in TLS

[[e-mail] (Martin Rex)]

Watson Ladd wrote:
>
> I mean exactly what I said: no more and no less. Implementations must
> be carefully
> audited to establish freedom from side-channels, no matter what
> primitive they implement.

That is the theory.

Now practice is an entirely different matter.

If you look through the algorithms in the appendices of FIPS 186-3,
you'll find a lot of algorithms that contain conditionals.

If the algorithm will have to be used inband for an asymmetric
crypto operation, those algorithms leak timing information
when processing secret values.

If a crypto operation needs an ephemeral random and secret prime,
this would apply to the necessary primality tests.

If the algorithm described by the underlying specification is not
100% constant time, why would you expect implementations
to have this property?


-Martin