# Is the context of "constant time" algorithms inclusive when you have a clock control?

There is generally a push to make algorithms and components constant time to be resistance to side channel attacks. For instance, AES-NI instructions take as many cycles as rounds; however, I can lower the CPU voltage and increase the clock speed until I see errors on the result. The circuits are only constant time if they satisfy the critical path propagation between latch boundaries.

When I read a paper that specifically says that it robust to side channel attacks because the algorithm is constant time, is the assumption that one does not have clock/voltage control?

To elaborate a bit on the boundaries that I mention, consider the following image that represents a pipeline of logic: In the image, there is a logic cloud that is operating on n-bits of information with a result. This is much like what a multiplicative inversion module looks like in hardware where you load the starting value and you then "latch" the result. The fundamental idea is that the clock line, CLK, is slow enough that you satisfy the worst-case propagation condition electrically. If I decrease the process voltage, and keep the clock the same speed, I can violate the path requirements. If I increase the clock speed for the same voltage, I also violate the requirements electrically.

• It's only about software side channels, not hardware side channels Commented Nov 25, 2017 at 17:28
• Can you elaborate a little on "critical path propagation between latch boundaries" Commented Nov 25, 2017 at 18:32
• @back_seat_driver I put in an image. Commented Nov 25, 2017 at 18:57
• @back_seat_driver In hardware design you have latches which are the default storage over multiple clock cycles. A critical path in a combinatorial circuit is the path through the gates with the longes delay. Thus if your propagation delay on your critical path is longer than a cycle, the value may not arrive during the current cycle at the storage. Commented Nov 25, 2017 at 19:59
• @back_seat_driver normally with flip-flops, data is stored on a clock edge, ie on a low-to-high voltage change of the clock input. Shortly after this point in time the output of the flip-flop has the stored value at which point the subsequent combinatorial logic gates (AND, OR, NOT, ...) start propagating the result of the new signal(s). Then at the next low-to-high clock edge, the current data at the latch's input is "written". If this happens before the data could propagate through the logic your overall expected clock count for the computation will be off. Commented Nov 25, 2017 at 23:06