New answers tagged timing-attack
2
Assuming the first code extract is translated straightforwardly to machine code (perhaps by blocking some compiler optimizations, or using a relatively dumb compiler) and executed on a CPU that performs no groundbreaking runtime optimization, it it is plausible that execution time has no dependency on the data in the arrays, except perhaps in the final 0 == ...
0
Your problem is the min. Here is one way to make a constant time min if you have a constant time subtractor and adder,
Let $Sub(x,y)$ be a constant time subtractor.
Let $Add(x,y)$ be a constant time adder.
Let $MSB(x)$ returns the sign bit.
//Inputs x and y are arrays with length property
//Returns the min of x and y in constant time
constantTimeMin(x,y)
...
8
Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time:
unsigned mul(unsigned char x, unsigned char y) {
unsigned r = x, s = x&-(y&1);
s += (r += r)&-((y >>= 1)&1);
s += (r += r)&-((y >>= 1)&1);
s +...
Top 50 recent answers are included
