4 ms·

Where suffer means "not be lazy, implement the assembly for your primitives in a lib, optimize it as best as you can without compromising security, do not let t

Where suffer means "not be lazy, implement the assembly for your primitives in a lib, optimize it as best as you can without compromising security, do not let the compiler 'improve' it"

Dylan16807 2y ago
But then you're not writing C, except maybe as some wrappers. Wanting to use C isn't laziness. Making it nearly unfeasible to use C is the most suffering a C compiler can inflict.
- g15jv2dp 2y ago
  There's no reason that C should be suitable for every purpose under the sun.
  - Dylan16807 2y ago
    Fiddling some bits cross-platform is supposed to be one of them.
    - zdragnar 2y ago
      As was pointed out elsewhere, fiddling bits with constant time guarantees isn't part of the C specification. You need a dedicated implementation that offers those guarantees, which isn't clang (or C, to be pedantic).
      - Dylan16807 2y ago
        It's not in the spec right now but it still feels solidly in C's wheelhouse to me.
        viraptor 2y ago
        Fortunately you don't have to go 100% one way or the other. Write your code in C, compile and check it's correct and constant time, then commit that assembly output to the repo. You can also clean it up yourself or add extra changes on top. You don't need to rely on C to guarantee some behaviour forever.
        uecker 2y ago
        I agree that an extension (e.g. a pragma or some high-level operations similar to ckd_{add,sub,mul}) that allows writing code with fixed timing would be very useful. But we have generally the problem that there are far more people complaining that actually contributing usefully to the ecosystem. For example, I have not seen anybody propose or work on such an extension for GCC.
        PhilipRoman 2y ago
        The problem doesn't stop there, if you want to ensure constant time behaviour you must also be able to precisely control memory loads/stores, otherwise cache timings can subvert even linear assembly code. If you have to verify the assembly, might as well write it in assembly.
        NohatCoder 2y ago
        The cryptographic constant time requirement only concerns operations that are influenced by secret data. You can't learn the contents of say a secret key by how long it took to load from memory. But say we use some secret data to determine what part of the key to load, then the timing might reveal some of that data.
    - account42 2y ago
      Not when the precise timing of operations matters.

Where suffer means "not be lazy, implement the assembly for your primitives in a lib, optimize it as best as you can without compromising security, do not let the compiler 'improve' it"

Dylan16807 2y ago

But then you're not writing C, except maybe as some wrappers. Wanting to use C isn't laziness. Making it nearly unfeasible to use C is the most suffering a C compiler can inflict.

g15jv2dp 2y ago
There's no reason that C should be suitable for every purpose under the sun.
- Dylan16807 2y ago
  Fiddling some bits cross-platform is supposed to be one of them.
  - zdragnar 2y ago
    As was pointed out elsewhere, fiddling bits with constant time guarantees isn't part of the C specification. You need a dedicated implementation that offers those guarantees, which isn't clang (or C, to be pedantic).
    - Dylan16807 2y ago
      It's not in the spec right now but it still feels solidly in C's wheelhouse to me.
      - viraptor 2y ago
        Fortunately you don't have to go 100% one way or the other. Write your code in C, compile and check it's correct and constant time, then commit that assembly output to the repo. You can also clean it up yourself or add extra changes on top. You don't need to rely on C to guarantee some behaviour forever.
      - uecker 2y ago
        I agree that an extension (e.g. a pragma or some high-level operations similar to ckd_{add,sub,mul}) that allows writing code with fixed timing would be very useful. But we have generally the problem that there are far more people complaining that actually contributing usefully to the ecosystem. For example, I have not seen anybody propose or work on such an extension for GCC.
      - PhilipRoman 2y ago
        The problem doesn't stop there, if you want to ensure constant time behaviour you must also be able to precisely control memory loads/stores, otherwise cache timings can subvert even linear assembly code. If you have to verify the assembly, might as well write it in assembly.
        NohatCoder 2y ago
        The cryptographic constant time requirement only concerns operations that are influenced by secret data. You can't learn the contents of say a secret key by how long it took to load from memory. But say we use some secret data to determine what part of the key to load, then the timing might reveal some of that data.
  - account42 2y ago
    Not when the precise timing of operations matters.