5 ms·

RSA is not "modern". Modern elliptic curves are chosen with side channels in mind. You won't find data-dependent branches or look-ups in straightforward implem

• rdtsc 11y ago
  > You won't find data-dependent branches or look-ups in straightforward implementations of Curve25519 As it was pointed out already starting since Pentium 4, for example, the same assembly instruction "add dest, src" might take a different time depending on the value of dest and src. Unless those modern elliptic curve compensate for specific models of CPUs they run on, their straight C and assembly code might behave as if it has data dependent branches.
  • sdevlin 11y ago
    Are you talking about this paper? https://gmplib.org/~tege/x86-timing.pdf https://gmplib.org/~tege/x86-timing.pdf I only saw evidence of data-dependent timing with respect to the div operation, but maybe I missed something. Of course, I am not suggesting other operations are inherently immune to data-dependent timing leaks. EDIT: I see there are also some notes on adc and sbb in some situations, i.e. chains of instructions that all light up the carry flag.
    • raverbashing 11y ago
      Don't worry about the instruction, worry about dest, src. If they: - Are in cache - Were touched by a previous instruction (regardless of cache) - Their cache line was touched by a previous instruction - Will be read/write (immediately) after that instruction - You're accessing data shared by multiple cores (lock prefix) timing will vary
      • sdevlin 11y ago
        That's the whole point, though - the algorithm is very straightforward to implement without data-dependent look-ups. So while any of those could affect execution time, none should do so in a way that leaks data.