New answers tagged timing-attack
2
Assuming the first code extract is translated straightforwardly to machine code (perhaps by blocking some compiler optimizations, or using a relatively dumb compiler) and executed on a CPU that performs no groundbreaking runtime optimization, it it is plausible that execution time has no dependency on the data in the arrays, except perhaps in the final 0 == ...
0
Your problem is the min. Here is one way to make a constant time min if you have a constant time subtractor and adder,
Let $Sub(x,y)$ be a constant time subtractor.
Let $Add(x,y)$ be a constant time adder.
Let $MSB(x)$ returns the sign bit.
//Inputs x and y are arrays with length property
//Returns the min of x and y in constant time
constantTimeMin(x,y)
...
8
Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time:
unsigned mul(unsigned char x, unsigned char y) {
unsigned r = x, s = x&-(y&1);
s += (r += r)&-((y >>= 1)&1);
s += (r += r)&-((y >>= 1)&1);
s +...
Top 50 recent answers are included
Related Tags
timing-attack × 92side-channel-attack × 26
aes × 15
implementation × 14
rsa × 11
cryptanalysis × 6
elliptic-curves × 5
hmac × 5
attack × 4
encryption × 3
hash × 3
signature × 3
authentication × 3
tls × 3
openssl × 3
gcm × 3
montgomery-multiplication × 3
public-key × 2
algorithm-design × 2
keys × 2
passwords × 2
s-boxes × 2
password-hashing × 2
encoding × 2
schnorr-signature × 2