3 ms·

Unless I am misunderstanding something, this flag only seems to affect about 10 instructions. Most of the ones you would expect to be involved with cryptograph

Unless I am misunderstanding something, this flag only seems to affect about 10 instructions. Most of the ones you would expect to be involved with cryptography already have data-independent timing regardless of the value of the MSR. The list Intel provides is here: https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/resources/data-operand-independent-timing-instructions.html https://www.intel.com/content/www/us/en/developer/articles/t...

marcosdumay 4y ago
There are some very important instruction on that small set. Most of the integral arithmetic is there.
- jcranmer 4y ago
  The intro matter is a bit hard to parse, but my understanding is that everything on that page is supposed to be constant-time, but the things that have "True" in the final column are the ones that aren't constant-time unless you twiddle on MSR on some systems. Most of the integer instructions you'd expect to be constant-time are in fact constant-time; it's a slice of vector integer multiply (and integer multiply-adds) that are inadvertently not constant-time.
  - AshamedCaptain 4y ago
    No, that's the wrong way to parse it, as there are explicitly _two_ bits on the MSR (DOITM and MCDT), and this thread is about DOITM. All the instructions in the list are no longer (guaranteed to be?) constant-time unless the DOITM bit is set. > Specifically, when data operand independent timing mode [DOITM] is enabled, instructions within the data operand independent timing subset execute with timing (in terms of processor cycles) that is independent of the data values in the sources of the instruction
jcranmer 4y ago
More specifically, there are a few things I take away from this list: * Vector integer multiply instructions may be data-dependent in some circumstances. * Intel appears to be willing to commit to making most integer instructions constant-time. * Some of the vector integer multiply instructions appear to be largely reusing the floating-point FMA units (VPMADD52* is a pretty strong clue there--52 bits covers the size of the mantissa in double-precision), and those units appear to have some non-constant-time behavior.
rrss 4y ago
The true/false on that page indicates whether the instruction has “MXCSR Configuration Dependent Timing.” This is separate from their sensitivity to the data-operand independent timing MSR bit. My interpretation is that all of the instructions in that list require DOIT set for guarantees of data independent timing > a new model specific register (MSR) control enables data operand independent timing for the listed data operand independent timing instructions. https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html https://www.intel.com/content/www/us/en/developer/articles/t...
dooglius 4y ago
Division, remainder, and memory access are data-dependent, someone who didn't know better could easily put those in a cryptographic algorithm (or worse, a compiler could transform a program into using these).

marcosdumay 4y ago

There are some very important instruction on that small set. Most of the integral arithmetic is there.

jcranmer 4y ago
The intro matter is a bit hard to parse, but my understanding is that everything on that page is supposed to be constant-time, but the things that have "True" in the final column are the ones that aren't constant-time unless you twiddle on MSR on some systems. Most of the integer instructions you'd expect to be constant-time are in fact constant-time; it's a slice of vector integer multiply (and integer multiply-adds) that are inadvertently not constant-time.
- AshamedCaptain 4y ago
  No, that's the wrong way to parse it, as there are explicitly _two_ bits on the MSR (DOITM and MCDT), and this thread is about DOITM. All the instructions in the list are no longer (guaranteed to be?) constant-time unless the DOITM bit is set. > Specifically, when data operand independent timing mode [DOITM] is enabled, instructions within the data operand independent timing subset execute with timing (in terms of processor cycles) that is independent of the data values in the sources of the instruction

jcranmer 4y ago

More specifically, there are a few things I take away from this list: * Vector integer multiply instructions may be data-dependent in some circumstances. * Intel appears to be willing to commit to making most integer instructions constant-time. * Some of the vector integer multiply instructions appear to be largely reusing the floating-point FMA units (VPMADD52* is a pretty strong clue there--52 bits covers the size of the mantissa in double-precision), and those units appear to have some non-constant-time behavior.

rrss 4y ago

The true/false on that page indicates whether the instruction has “MXCSR Configuration Dependent Timing.” This is separate from their sensitivity to the data-operand independent timing MSR bit. My interpretation is that all of the instructions in that list require DOIT set for guarantees of data independent timing > a new model specific register (MSR) control enables data operand independent timing for the listed data operand independent timing instructions. https://www.intel.com/content/www/us/en/developer/articles/technical/software-security-guidance/best-practices/data-operand-independent-timing-isa-guidance.html https://www.intel.com/content/www/us/en/developer/articles/t...

dooglius 4y ago

Division, remainder, and memory access are data-dependent, someone who didn't know better could easily put those in a cryptographic algorithm (or worse, a compiler could transform a program into using these).