When operating a block cipher in CTR or GCM mode, should the function used to increment the counter or initialization vector be near-constant time? Here, I'm wondering about the "addition with carry" that often occurs. For example:
void IncrementCounterByOne(byte *inout, unsigned int size)
{
for (int i=int(size-1), carry=1; i>=0 && carry; i--)
carry = !++inout[i];
}
In the function above, processing terminates when carry
is 0.
While not readily apparent, some protocols treat the counter or initialization vector as secret or private data (like TLS). That appears to beg a near-constant time function to avoid leaking information.
I realize there will likely be CPU micro-code variations, and there's probably nothing that can be done about it. (Corrections, please).
A related question is, should the Increment function be near-constant time when it increments the seed to an ANSI X9.17 or X9.31 generator.
And a question I am not asking: should a counter or iv be considered public or secret information. Some projects, like TLS, have already made that decision.