4 ms·
There is no reason that an optimizing compiler doesn't "optimize" your function to non-constant time.
by leni536 7y ago
There is no reason that an optimizing compiler doesn't "optimize" your function to non-constant time.
- saagarjha 7y agoWhile downvoted at the time of my response, this answer is correct. The optimizing compiler makes no timing guarantees, so it's not required to use any of the constructs in your second answer at all. If you need guaranteed timing, you cannot use standard C (instead use assembly or compiler extensions).
- cyphar 7y agoA proper implementation uses the correct compiler intrinsics and hints to cause such operations to be constant-time. Timing problems are a fairly well-known problem in cryptography and constant-time implementations are often required for safe cryptography.
- leni536 7y agoFair enough. I just wanted to point out that standard C is inadequate on its own. I'm pretty sure that cryptographers are aware of this.
- mratsim 7y agoOften that hints boils down to use assembly though. Constant-time is a pain to achieve and new compiler optimizations might make your code not constant-time anymore: https://www.cl.cam.ac.uk/~rja14/Papers/whatyouc.pdf https://www.cl.cam.ac.uk/~rja14/Papers/whatyouc.pdf Given that I'm writing such a cryptographic library, I am very interesting on the compiler hints you use.