Imagine a branchless implementation of the AES-128 cipher. Are there any benefits over the implementation that contains branches, other than possible prevention of timing attacks?

Is it even true, that a branchless code can mitigate a timing attack? Are there any other side-channel attacks that are prevented in this way?


What makes crypto code vulnerable to timing attacks is data dependent timing variations. Branching according to a round counter, or to the key size, does not create a vulnerability. Most implementations of AES make no branch according to key or data value, and supressing other branches won't help.

The main source of data-dependent timing variations in AES is in the table lookups for the S-boxes: according to if the entry is in cache, or not, the table fetch will take different time. See for example Daniel J. Bernstein, Cache-timing attacks on AES (2004) [direct link to pdf] for more info.

Among ways to make AES code free of any timing dependencies are:

  • $\begingroup$ Is it possible to replace the lookup table (S-box) with a branchless code to eliminate the weakness? $\endgroup$ – Daniel Lovasko Nov 18 '15 at 17:49
  • $\begingroup$ The link you provided mentions a constant-time AES implementation, I will read the whole PDF later, to understand things more thoroughly. Thanks. $\endgroup$ – Daniel Lovasko Nov 18 '15 at 17:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.