4 ms·

A thing that I've been wondering is, would it be enough in this specific case to turn off compiler optimizations, e.g. by using GCC's -O0 flag?

by GTP 2y ago

photochemsyn 2y ago
Libsodium does this compiler-specific pragmas and attributes (like __attribute__((optimize("O0")))). It's also the cryptographic library mentioned in this study with the smallest number of discovered issues, but: > "However, we want to note that libsodium is the smallest library that we test with the most limited support for cryptographic primitives. For example, libsodium does not support the elliptic curve secp256; instead,they do all of their elliptic curve operations on curve25519. Therefore, it may be unfair to compare to larger libraries with support for more cryptographic primitives."
- GTP 2y ago
  Thanks, the fact that they still found issues answers my question.
- badmintonbaseba 2y ago
  "The optimize attribute should be used for debugging purposes only. It is not suitable in production code." https://gcc.gnu.org/onlinedocs/gcc-14.2.0/gcc/Common-Function-Attributes.html https://gcc.gnu.org/onlinedocs/gcc-14.2.0/gcc/Common-Functio...
- jedisct1 2y ago
  > Libsodium does this compiler-specific pragmas and attributes (like __attribute__((optimize("O0")))) It doesn't do anything like that.
SAI_Peregrinus 2y ago
In general, no. Optimizations from a compiler can't do anything regular code gen isn't allowed to do. It's just they're more likely to do some things. So in practice disabling optimization (especially using pragmas or attributes for certain critical functions) can help, but it can't be considered truly reliable.
recursivecaveat 2y ago
In this specific case, in practice, maybe. At end the of the day though it is like trying to write a metred poem in a foreign language by writing English and passing it through google translate. You're trying to precisely control properties of the output with a tool that was not designed for it, doesn't realize what you're doing, and has at every step many possible alternatives. Any success you have is tied to a specific version of the tool, there are no guarantees.
fanf2 2y ago
The paper says, « We found binaries with issues in all optimization levels as depicted in Figure 3. We observe notable drops for LLVM's and GCC's -O0. We believe that fewer enabled optimizations also lead to fewer compiler-induced issues. We discuss in Section VII that optimizations are one of the reasons compilers introduce side channels; thus fewer optimizations could mean defensive programming techniques are less likely to get inter-fered with. However, we note that this cannot be considered a solution to compiler-induces issues as we still observe some issues with -O0. We discuss these further in Section VI-D. »
cryptonector 2y ago
Unreliable. But in combination with tests of constant-time-ness then it's ok in the short-term. In the long-term it'd be nice if the language and tooling could be told "this is to be constant-time", and even better to have a language specially crafted for these sorts of things, something between assembly and C.

A thing that I've been wondering is, would it be enough in this specific case to turn off compiler optimizations, e.g. by using GCC's -O0 flag?

by GTP 2y ago

A thing that I've been wondering is, would it be enough in this specific case to turn off compiler optimizations, e.g. by using GCC's -O0 flag?

photochemsyn 2y ago

Libsodium does this compiler-specific pragmas and attributes (like __attribute__((optimize("O0")))). It's also the cryptographic library mentioned in this study with the smallest number of discovered issues, but: > "However, we want to note that libsodium is the smallest library that we test with the most limited support for cryptographic primitives. For example, libsodium does not support the elliptic curve secp256; instead,they do all of their elliptic curve operations on curve25519. Therefore, it may be unfair to compare to larger libraries with support for more cryptographic primitives."

GTP 2y ago
Thanks, the fact that they still found issues answers my question.
badmintonbaseba 2y ago
"The optimize attribute should be used for debugging purposes only. It is not suitable in production code." https://gcc.gnu.org/onlinedocs/gcc-14.2.0/gcc/Common-Function-Attributes.html https://gcc.gnu.org/onlinedocs/gcc-14.2.0/gcc/Common-Functio...
jedisct1 2y ago
> Libsodium does this compiler-specific pragmas and attributes (like __attribute__((optimize("O0")))) It doesn't do anything like that.

SAI_Peregrinus 2y ago

In general, no. Optimizations from a compiler can't do anything regular code gen isn't allowed to do. It's just they're more likely to do some things. So in practice disabling optimization (especially using pragmas or attributes for certain critical functions) can help, but it can't be considered truly reliable.

recursivecaveat 2y ago

In this specific case, in practice, maybe. At end the of the day though it is like trying to write a metred poem in a foreign language by writing English and passing it through google translate. You're trying to precisely control properties of the output with a tool that was not designed for it, doesn't realize what you're doing, and has at every step many possible alternatives. Any success you have is tied to a specific version of the tool, there are no guarantees.

fanf2 2y ago

The paper says, « We found binaries with issues in all optimization levels as depicted in Figure 3. We observe notable drops for LLVM's and GCC's -O0. We believe that fewer enabled optimizations also lead to fewer compiler-induced issues. We discuss in Section VII that optimizations are one of the reasons compilers introduce side channels; thus fewer optimizations could mean defensive programming techniques are less likely to get inter-fered with. However, we note that this cannot be considered a solution to compiler-induces issues as we still observe some issues with -O0. We discuss these further in Section VI-D. »

cryptonector 2y ago

Unreliable. But in combination with tests of constant-time-ness then it's ok in the short-term. In the long-term it'd be nice if the language and tooling could be told "this is to be constant-time", and even better to have a language specially crafted for these sorts of things, something between assembly and C.