For a while, I was experimenting with optimization of several crypto implementations with SIMD (Single Instruction Multiple Data ) made available by
C compiler extensions.
Since, crypto implementations are all about constant time and fast execution, they are optimized to do the same. SIMD has gained massive importance in this area, because we can execute an instruction, on multiple data points simultaneously. This enables vectorization of performance draining parts of code.
I need not emphasize on the performance of SIMD, but I'm worried about its security, despite the performance benefits that it offers.
For example: The ordinary
mull instruction may not be constant time on most platforms. Let's imagine that we have a vectorized
mull instruction on that platform that operates on two 128 bit registers and outputs another 128 bit register. Let's assume that the lane size is 8 bytes. So, if the multiplication of two corresponding lanes is not constant time, won't that create a net difference in the entire SIMD operation, even though we are operating on multiple data points simultaneously.
Can this lead to software side channel attacks ?
- Can there be software vulnerabilities to a crypto implementation that uses SIMD ?
- Can some physical sensor trace the operations as well as the contents of a SIMD register by monitoring the CPU ?