I've implemented AES in my library with several variations: a straight C version, a version using x86 SSSE3, and a version using x86 AES-NI. The SSSE3 and AES-NI implementations are constant-time, whereas the C implementation uses lookup tables.

My SSSE3 implementation is a bit (~20%) slower than my C implementation. It doesn't use bit-slicing, so as to support CBC encryption. AES-NI, of course, is at least 15x faster than either of the other two.

How important is it that my implementation prevents timing attacks? I'm wondering whether I should ditch my SSSE3 implementation and stick with straight C.

  • 1
    $\begingroup$ I would suggest using an existing library -- there are many available. Is there any particular reason for writing your own? $\endgroup$ – Demi Feb 18 '16 at 7:06
  • 2
    $\begingroup$ it really depends on what you are using it for, timing attacks are most effective in a virtualized environment or in hardware, in many other cases, if the attacker has the ability to mount a timing attack, they have enough control of the system to read keystrokes and data from disk. $\endgroup$ – Richie Frame Feb 18 '16 at 7:09
  • 1
    $\begingroup$ Also, I would suggest bitslicing – many applications do not need CBC mode, and bitslicing provides a large speed advantage. $\endgroup$ – Demi Feb 18 '16 at 7:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.