I'm afraid that the general AES implementation in Go is not constant-time. If you have a machine with AESNI instructions then they will be used and they are con

I'm afraid that the general AES implementation in Go is not constant-time. If you have a machine with AESNI instructions then they will be used and they are constant time. AES is terribly hard to implement in a performant and constant-time fashion. The OpenSSL work is very impressive but, at least the bits that I'm aware of, are still very platform dependent and sometimes work only for certain modes (i.e. counter mode). Patches to implement Käsper and Schwabe's or Mike Hamburg's AES designs would be welcome, of course! RC4 isn't constant time, but that's not the biggest problem with RC4. All common hash functions are. If you need constant-time crypto and aren't tied to implementing an existing protocol then there is an implementation of NaCl's box[1] and secretbox in the go.crypto subrepo. Otherwise, the modexp isn't constant-time, but RSA secret operations are blinded (hopefully correctly). P-224 is constant time, but P-{256,384,521} are generic code and are not. (I have a Go suitable P-256 design ready if I can find the time.) In general, Go has not had nearly the review that OpenSSL has had and caution is warranted because of that. [1] http://godoc.org/code.google.com/p/go.crypto/nacl/box http://godoc.org/code.google.com/p/go.crypto/nacl/box