3 ms·

In an ideal world, a cryptography library wouldn't have to care about these kind of details. It would be written in a completely cross-platform, mathematically

In an ideal world, a cryptography library wouldn't have to care about these kind of details. It would be written in a completely cross-platform, mathematically pure fashion, and it would be the job of the platform to prevent information leaks (constant time, constant power consumption, ...). I wonder if there is a CPU that you can switch to "constant resource mode" where it runs everything in fixed time, albeit slower? Or maybe you could run cryptographic operations in a black box (like an extra chip or a networked node) that replies on a fixed schedule?

Filligree 4y ago
> I wonder if there is a CPU that you can switch to "constant resource mode" where it runs everything in fixed time, albeit slower? Or maybe you could run cryptographic operations in a black box (like an extra chip or a networked node) that replies on a fixed schedule? I believe you can disable the CPU cache on x86, which at least gets closer. However, “slower” in this case means thousands of times slower.
- convolvatron 4y ago
  no problem..i'll just hang out here until you come up with a general way to transform an O(n) operation for arbitrary n into a 1000x constant time one.
  - Filligree 4y ago
    Sleep until 1s total has passed. If the operation took more than that, panic. I don't think that's very practical, though. :V
  - captainmuon 4y ago
    Bounded time. If you have some operation that could leak information, like checking if a key can decrypt something, take the longest possible time and then add some, and only return after that time. If it takes 50 ms per request then so be it. Edit in response to sibling: Imagine it doesn't just take 1s but it also makes a clicking noise like a relay. You could still do 10000 requests/second if you install 10000 of them :-D. I wonder if for certain use cases it would be worth the trade-off, if you had proof of absolutely being side-channel free.

Filligree 4y ago

> I wonder if there is a CPU that you can switch to "constant resource mode" where it runs everything in fixed time, albeit slower? Or maybe you could run cryptographic operations in a black box (like an extra chip or a networked node) that replies on a fixed schedule? I believe you can disable the CPU cache on x86, which at least gets closer. However, “slower” in this case means thousands of times slower.

convolvatron 4y ago
no problem..i'll just hang out here until you come up with a general way to transform an O(n) operation for arbitrary n into a 1000x constant time one.
- Filligree 4y ago
  Sleep until 1s total has passed. If the operation took more than that, panic. I don't think that's very practical, though. :V
- captainmuon 4y ago
  Bounded time. If you have some operation that could leak information, like checking if a key can decrypt something, take the longest possible time and then add some, and only return after that time. If it takes 50 ms per request then so be it. Edit in response to sibling: Imagine it doesn't just take 1s but it also makes a clicking noise like a relay. You could still do 10000 requests/second if you install 10000 of them :-D. I wonder if for certain use cases it would be worth the trade-off, if you had proof of absolutely being side-channel free.