4 ms·

I think this is cool, but how sure are the authors that this is side-channel safe? There is a similar (modular, high performance, zero-dependency) library in Co

I think this is cool, but how sure are the authors that this is side-channel safe? There is a similar (modular, high performance, zero-dependency) library in Common Lisp but it can't give side-channel guarantees due to how some Common Lisp compilers implement integer and arithmetic functions https://github.com/sharplispers/ironclad https://github.com/sharplispers/ironclad

mratsim 2y ago
Great question, first of all I did extensive research https://github.com/mratsim/constantine/wiki/Constant-time-arithmetics https://github.com/mratsim/constantine/wiki/Constant-time-ar.... Then the library defines its own types SecretBool and SecretWord throughough library that cannot be mixed with regular Nim types and are based on uint32/uint64 so the compiler cannot assume 0/1 and do boolean logic. Assembly is used to avoid compilers getting too smart and reintroducing branches but the no-assembly fallback should still compile without branches. By convention, all variable-time cryptographic functions are suffixed _vartime. There is a plan to add automated constant-time checks as well https://github.com/mratsim/constantine/issues/7 https://github.com/mratsim/constantine/issues/7.