Hacker News Reader

Comment by loup-vaillant | Hacker News Reader

I confess I'm quite tired of having to litter every article that might be about cryptography with the standard warnings. I might as well warn readers not to use this knowledge at all, because they shouldn't implement their own crypto to begin with (even though I did).

This is an advanced topic. If the reader is in a position to use such knowledge, I felt I could safely assume they would know when it is safe not to be constant time. (For instance, signature verification doesn't process secrets, and can be variable time.)

> also, no mention of masking techniques!

Out of scope. Those are hidden behind magical constant time routines.

View on HN

>> also, no mention of masking techniques!

> Out of scope. Those are hidden behind magical constant time routines.

How is that? Side-channel resistance is largely a matter of reducing the Signal-to-Noise ratio for traces an attacker can leverage to extract secrets. A constant-time logic reduces the Signal; a masking logic increases the noises. The two are largely independent and at times at odds. For instance, recent fast curves (like DJB's) are good because they can be easily implemented in constant time in software (as far as we know) but they are actually much harder to mask (in software or hardware).

Oh, I thought you were talking about the bit twiddling required to implement constant time lookup and constant time branching.

> Side-channel resistance is largely a matter of reducing the Signal-to-Noise ratio for traces an attacker can leverage to extract secrets.

Who cares about resistance when you can have immunity? Constant time crypto leaks zero signal through timings, who needs any noise to mask that utter absence of signal?

Unless maybe you were thinking about other side channels, such as energy consumption, or electromagnetic emissions? I'd agree those are worth pursuing for smart cards and dongles, but on regular computers (from palmtops to servers), the threat is mostly academic.

Reply on news.ycombinator.com