5 ms·
> The concern about introducing side-channels into crypto apps seems legitimate If you're relying on compiler optimization levels to enforce stuff about crypto
by munin 11y ago
> The concern about introducing side-channels into crypto apps seems legitimate
If you're relying on compiler optimization levels to enforce stuff about crypto, you're gonna have a bad time. What happens when compiler behavior changes from minor revision to minor revision? Are you going to stare at the assembly code to make sure that something you did that was fair game for the optimizer to play with changed, or are you going to write your code so that it does the same thing no matter a (relatively correct) compiler and optimizer?
If your code had UB in it, you're already hosed and it's a matter of when. Fix that. There are primitives like RtlSecureZeroMemory to deal with the intersection of cryptography/security and compiler optimizations. We've mapped this terrain.
- tptacek 11y agoYes: if you care about side channels, you are going to evaluate the assembly code your compiler generates.
- munin 11y agoThat works once. Are you going to do it every time you compile? I guess the side channel crew can be appeased in the llvm bitcode view of the world - write your side channel resistant stuff in inline assembler. The bitcode optimizer can't touch it then. (edit-apple probably keeps you from doing this though)
- teacup50 11y agoYes, assembly (inline or not) isn't supported on tvOS/watchOS. It is grandfathered-in on iOS, but the direction is clear.
- MaulingMonkey 11y ago> That works once. Are you going to do it every time you compile? Sounds like a good case for a unit test.
- tedunangst 11y agoI think if you care that much, you're writing asm. If you care slightly less, you write C that looks constant time. Inspecting generated assembly is a strange middle ground between too fragile for the paranoid and too much work for the not paranoid.
- NateLawson 11y agoGreat point. Why check what might later change when you can enforce it now and going forward?
- vardump 11y agoConstant time C? Some instructions have data dependent execution times, even when no branches are used. Some memory operations have also data dependent timings. I don't think constant time C is feasible.
- NateLawson 11y agoClose, but you're actually using inline asm in most cases. Then you're verifying the microarchitectural details of every CPU it executes on. (Intel's OpenSSL countermeasure to an RSA timing attack was dependent on CPUs not coming out with narrower cache lines than a predefined constant, but one did later.) It's difficult to get high assurance in software. Best bet is to design algorithms to avoid data-dependent accesses (see: djb).