Kyber constant time division #3898
Conversation
|
Perhaps describe the counter measure in side_channel.rst? |
Co-authored-by: René Meusel <[email protected]>
There was a problem hiding this comment.
TBH I don’t see how this helps keep the compiler from turning the multiplication into a div, since the multiplicand will anyway be known at compile time.
One thing I find interesting here is that after the (comple time) computation of pm, the final result is computed using just a multiplication and a single shift. Wheras the current approach uses a multiplication and several shifts, add/sub, etc. If we just took the value that would be computed for pm for the Kyber q and used it directly (return (n * MAGIC) >> MAGIC_SHIFT), is there really any risk of variable time operations being compiled in? I would think no (non-malicous) compiler would convert 2 instructions into a div or jump.
|
Closed. See #3959. |
Pull request dependencies
This PR adds logic to perform constant-time division by replacing division with a multiplication and right-shift. Instead of using magic numbers for division and right-shift for the specific Kyber constant Q, we compute them on compile time using an algorithm from Hacker's Delight, Chapter 10 - 9.
Also, to ensure the algorithm's correctness, we added a test covering all possible numerators that may occur in Kyber's computation.
Commit:
58a9962