3 ms·
My understanding is that for crypto specifically it constant-time algorithms matter due to security implications, and those are only available when you use spec
by nasretdinov 1y ago
My understanding is that for crypto specifically it constant-time algorithms matter due to security implications, and those are only available when you use specific branchless assembly instructions, so it's not just performance
- charcircuit 1y agoCPUs do not guarantee that branchless instructions always take the same amount of time.
- Arnavion 1y agoCPUs guarantee what they guarantee, and if they guarantee that a certain instruction takes an operand-independent time then it does. For example a RISC-V CPU implementing the Zkt extension is required to implement a whole bunch of logical and arithmetic integer operations with operand-independent timing. This includes the two "branchless move" instructions from the Zicond extension, czero.eqz and czero.nez.
- foobiekr 1y agoJust to pick nits, the important thing is basically no secret-dependent { branches, loop bounds checks, memory accesses }. This is a lot more complex than simple "constant time."