5 ms·

OT but the chacha20 code IIRC spills badly with either gcc or clang.

ncmncm 7y ago
Off topic or no, this is very disturbing. Are we talking about power noise, or timing noise? The former is generally hard to counter, but we should be able to get our timing right. And doesn't DJB understand all this well enough to get the code right?
- JoachimSchipper 7y ago
  Your parent is talking about register spills to memory. Using memory instead of registers may be somewhat inefficient, but it's still constant-time (i.e. no dependence on the key etc.)
  - a1369209993 7y ago
    If the attacker has Meltdown/Specter-style access to your stack, register spills (especially but exclusively if not overwritten when you're done) can compromise your keys, but you need to have a rather weird threat model to avoid having them just read the actual keys out whatever storage you got them from in the first place.
cesarb 7y ago
This is kind of hard to avoid without hand-coded assembly or careful use of vector intrinsics. The core of chacha20 is a 4x4 matrix, which would need 16 registers to hold without spilling (plus a few more for temporary use during the calculations). Both 64-bit x86 and 32-bit ARM have only 15 or 16 general-purpose registers.
- a1369209993 7y ago
  FWIW x64 effectively has 32 GPRs worth of 32-bit registers, which is what chacha20 needs. You'd need to access them as something like: add eax r8d rol r8 32 add edx r8d though, so several are useless due to clobbering, and you'd need to schedule things rather weirdly. Also, where did you get the RNG state from, if you don't trust memory to be read-what-where-proof?
  - dependenttypes 7y ago
    You could also use the SSE/AVX registers.
    - a1369209993 7y ago
      Probably true (I think all x64 hardware includes SSE at least), but they did imply they were trying to use just the scalar instructions. (They also said no hand-assembly, but something like: register uint64_t ra,rd,... ra += 0xFFFFFFFF&r8 rd += r8 >> 32 should accomplish much the same thing given a resonably well-developed compiler.)

Off topic or no, this is very disturbing. Are we talking about power noise, or timing noise? The former is generally hard to counter, but we should be able to get our timing right. And doesn't DJB understand all this well enough to get the code right?

JoachimSchipper 7y ago
Your parent is talking about register spills to memory. Using memory instead of registers may be somewhat inefficient, but it's still constant-time (i.e. no dependence on the key etc.)
- a1369209993 7y ago
  If the attacker has Meltdown/Specter-style access to your stack, register spills (especially but exclusively if not overwritten when you're done) can compromise your keys, but you need to have a rather weird threat model to avoid having them just read the actual keys out whatever storage you got them from in the first place.

cesarb 7y ago

This is kind of hard to avoid without hand-coded assembly or careful use of vector intrinsics. The core of chacha20 is a 4x4 matrix, which would need 16 registers to hold without spilling (plus a few more for temporary use during the calculations). Both 64-bit x86 and 32-bit ARM have only 15 or 16 general-purpose registers.

a1369209993 7y ago
FWIW x64 effectively has 32 GPRs worth of 32-bit registers, which is what chacha20 needs. You'd need to access them as something like: add eax r8d rol r8 32 add edx r8d though, so several are useless due to clobbering, and you'd need to schedule things rather weirdly. Also, where did you get the RNG state from, if you don't trust memory to be read-what-where-proof?
- dependenttypes 7y ago
  You could also use the SSE/AVX registers.
  - a1369209993 7y ago
    Probably true (I think all x64 hardware includes SSE at least), but they did imply they were trying to use just the scalar instructions. (They also said no hand-assembly, but something like: register uint64_t ra,rd,... ra += 0xFFFFFFFF&r8 rd += r8 >> 32 should accomplish much the same thing given a resonably well-developed compiler.)