4 ms·

Have the library functions been tested (or proved) to be constant time ? This is a critical property of libsodium. Another question is what make the difference

• loup-vaillant 9y ago
  > Have the library functions been tested (or proved) to be constant time ? Just check the absence of secret dependent branches, and secret dependent array indices, it's pretty simple. > what make the difference in number of line of codes with libsodium ? Less lines means less need for eyeballs, tests, and audits. Libraries the size of TweetNaCl (and, to a lesser extent, Monocypher), can be subjected to very rigorous audits, and increase confidence accordingly. > what do these lines of of libsodium that your lib doesn't have contain ? I can see 3 sources: redundant primitives (Monocypher is not redundant), alternate implementation (Monocypher sticks to portable C), and verbose implementations (Monocypher keeps it simple). > Also, is this a fair metric ? Not quite: I did not count the size of the header in Monocypher and TweetNaCl. Still, I don't think Libsodium has less than 22K lines of actual code. (Note: I counted everything with sloccount) On the other hand, my lines never exceed 80 characters.