1
$\begingroup$

For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by C compiler extensions. Since, crypto implementations are all about constant time and fast execution, they are optimized to do the same. SIMD has gained massive importance in this area, because we can execute an instruction, on multiple data points simultaneously. This enables vectorization of performance draining parts of code.

I need not emphasize on the performance of SIMD, but I'm worried about its security, despite the performance benefits that it offers.

For example: The ordinary mull instruction may not be constant time on most platforms. Let's imagine that we have a vectorized mull instruction on that platform that operates on two 128 bit registers and outputs another 128 bit register. Let's assume that the lane size is 8 bytes. So, if the multiplication of two corresponding lanes is not constant time, won't that create a net difference in the entire SIMD operation, even though we are operating on multiple data points simultaneously.

Can this lead to software side channel attacks ?

  • Can there be software vulnerabilities to a crypto implementation that uses SIMD ?
  • Can some physical sensor trace the operations as well as the contents of a SIMD register by monitoring the CPU ?
Improve this question
$\endgroup$
  • 1
    $\begingroup$ the MUL instruction is constant time on every platform that I know, even SIMD. The problem on the x86 would be cache latency. That's the standard side channel attack. $\endgroup$ – b degnan Jul 12 '20 at 16:58
  • $\begingroup$ @bdegnan Thankyou, for the reply! Motorola PowerPC 7450 (G4e) has/had variable time mull as stated by Bernstein (DJB) in his research paper on Salsa family of stream ciphers cr.yp.to/snuffle/salsafamily-20071225.pdf $\endgroup$ – Vivekanand V Jul 12 '20 at 17:08
  • 1
    $\begingroup$ It's likely already known by other commenters, but floating point multiplication is highly non-constant time (reference). This doesn't have too many applications to crypto (although there are a few that I know of in lattice crypto). $\endgroup$ – Mark Jul 12 '20 at 17:20
  • 2
    $\begingroup$ Some processors have variable time (integer) multipliers, others have constant time. I believe that the general tendency is that higher-end CPUs (with lots of gates) tend to be constant time; lower end CPUs tend to have variable - of course, you need to check with the CPU manual to be certain. $\endgroup$ – poncho Jul 12 '20 at 18:57
  • 1
    $\begingroup$ @VivekanandV If you look at my other posts, you can imagine how an attack can be done with a picoammeter. $\endgroup$ – b degnan Jul 12 '20 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.