2 ms·
This is dangerous for security, because now your math operations are no longer O(1) and might allocate memory.
by astrange 3y ago
This is dangerous for security, because now your math operations are no longer O(1) and might allocate memory.
- nlitened 3y agoI think, if security is involved, one would still need to do overflow checks in the exact same places, so nothing is gained and nothing is lost.
- ack_complete 3y agoMight allocate a _lot_ of memory. I've actually seen a case where some fatfingered a comparison in Python as a << b instead of a < b, and allocated gigabytes of memory on a server.
- dreamcompiler 3y agoSide channels are hard to prevent in all languages because of compiler optimizations, out-of-order execution, branch prediction, speculative execution, loop unrolling, eliding operations, register renaming, using the FPU under the sheets for ordinary integers, clock throttling, cache usage, rowhammer, etc. Modern mostly-hidden, mostly-proprietary architectural execution models are hell for security and side channel prevention. We need chips from 1984 with Ghz clocks if we want good security.
- astrange 3y agoOh, this isn't (mainly) about sidechannel leaks. It's about DoS attacks.
- eru 3y agoIf you want to harder your code against timing attacks, you need to actively work hard, instead of just relying on some operations taking O(1). (I don't even know whether your processor does regular multiplication and division in O(1)?)
- astrange 3y ago> (I don't even know whether your processor does regular multiplication and division in O(1)?) Most of them don't, especially division.