3 ms·
It's both, and your example in parentesys actually provides a good example, as brances can both slow you down and provide a side channel (but in crypto I think
by GTP 4y ago
It's both, and your example in parentesys actually provides a good example, as brances can both slow you down and provide a side channel (but in crypto I think that in the particular case of branches only the second occurs).
If you're looking for an example that is more rooted into computer architecture, you can look at how implementing AES with lookup tables can provide a cache timing side channel.
- mlyle 4y agoWell, then I'd say the knowledge fits more in "3". It's not general purpose architectural knowledge, but rather the wealth of things we've learned from people thinking about side channels.
- GTP 4y agoI think it's hard to pick one between 2 and 3, as after knowing about a possible side channel from 3, you need 2 to prevent it on the specific architecture you'll run your code on.
- mlyle 4y agoI don't know that I agree. Simply speaking, the vast majority of cryptography work has nothing to do with tomfoolery to prevent side channels-- even if we're doing low-level fundamental algorithm stuff, which most of the time cryptographers are not doing. (When's the last time you thought about AES in detail?) The way people stumble is in protocol errors and fundamental errors of composition.
- GTP 4y agoYes, often mistakes happen at a higher level. But the "don't implement your own crypto" advice also covers implementations of primitives.