3 ms·

Is there difficulty implementing constant-time algorithms for async processors? For example, it is very desirable that every crypto operation takes exactly the

• sketerpot 17y ago
  You can always use a clock and a counter to delay for a period of time that you know is greater than the worst-case time that the operation could take. Or randomize it up a bit. Or design the logic to take similar times for all crypto operations. Here's another cool thing: by using a dual-rail encoding (one wire being high means a bit is 0, the other wire being high means the bit is 1) you can design logic that consumes roughly constant power no matter what the operands are. This makes power-analysis attacks a lot more difficult. Here's a paper on all this that you may enjoy: http://www.gemplus.com/smart/rd/publications/pdf/MAM03as.pdf http://www.gemplus.com/smart/rd/publications/pdf/MAM03as.pdf
• boots 17y ago
  There is definitely a very bound on the time that it could take, but one of the advantages of asynchronous is that you can design for the average case, not the worst case. Each circuit forms part of a data pipeline, and with enough data in this pipeline you can guarantee a maximum time limit. Unfortunately, to match the minimum to the maximum, you would likely have to design your implementation to be very slow. In the constant time case you remove all the pipelining advantages, as you would be required to 'fill' the pipeline.