3 ms·
> You realize that on x86_64, it probably compiles down to 1-2 instructions to write `diff != 0`, right? But will the 1-2 instruction compare be constant time?
by lmz 9y ago
> You realize that on x86_64, it probably compiles down to 1-2 instructions to write `diff != 0`, right?
But will the 1-2 instruction compare be constant time?
- lsiebert 9y agoconstant time comparison in crypto is potentially important because of timing attacks to gain information. Haven't looked at the code here to see if that's the case, nor am I a crypto expert, but see https://en.wikipedia.org/wiki/Timing_attack https://en.wikipedia.org/wiki/Timing_attack
- lmz 9y agoI am aware of that. I'm not sure about the poster claiming it reduces to "1-2 instructions".
- loup-vaillant 9y agoThey likely won't. They may compile into a conditional branch, which because of cache and pipeline invalidation do not run in constant time.