2 ms·
This is a good point! But to be maximally precise: variations between each ISA implementation's latencies is not particularly important; what's important is tha
by woodruffw 4y ago
This is a good point! But to be maximally precise: variations between each ISA implementation's latencies is not particularly important; what's important is that instructions on data-dependent paths are not themselves data-dependent in timing.
In other words: it's okay if AMD64 takes 9 cycles to execute an instruction while IA32e takes 7; the problem arises when AMD64 takes 9 + k cycles for k bytes of input while cryptographic engineers have tested on IA32e and assumed a constant overhead of 7 cycles.
- Gordonjcp 4y ago> the problem arises when AMD64 takes 9 + k cycles for k bytes of input while cryptographic engineers have tested on IA32e and assumed a constant overhead of 7 cycles. Why is that a problem? Doesn't that just leak something you could determine by just looking at the CPU type?
- bluGill 4y agoThat also leaks how many bytes of data are being processed. This sometimes matters. When checking for a password match you have to check all characters in the.string otherwise you leak where the mismatch was. Even in a properly salted and hashed scheme that makes breaking the password easier.
- jeroenhd 4y agoThese side channel attacks allow perfectly secure algorithms to leak plaintext or even complete keys.