Hacker News Reader

Comment by karma_pharmer | Hacker News Reader

This uses a flawed RSA implementation which is vulnerable to timing attacks:

https://deps.rs/repo/github/rpgp/rpgp#vulnerabilities

There is a reason why crypto primitives handling key material -- especially RSA and AES -- are not written in higher-level languages.

View on HN

I’m not sure you can really categorize rust as a high level language, unless you’re stating crypto primitives should only be written in assembly.

EDIT: Given this attack was also applied to OpenSSL, amongst many others this high level language comment seems doubly odd/dubious

EDIT2: another rust TLS implementation was among only 3 that was initially verified to be not vulnerable as well..

unless you’re stating crypto primitives should only be written in assembly

Yes, that's exactly what I'm stating.

Have a look at openssl, boringssl, nspr, etc. They all implement the core modular arithmetic for RSA and the s-box table for AES using assembly language. There is no reliable way to prevent a C compiler from "optimizing" your constant-time code into non-constant-time code.

another rust TLS implementation

rustls uses assembler (from boringssl) for these routines. It is not 100% rust, and that's a good thing.

Genuinely curious, why the downvotes?

Because you lack the understanding that different CPUs behave differently with the same instructions, so your "solution" to timing attacks doesn't solve anything until you force every device to have the same identical CPU.

Reply on news.ycombinator.com