From 53b0cfde580e86b03d0d27a488b6c134f662e957 Mon Sep 17 00:00:00 2001 From: Jack Lloyd Date: Sat, 19 Oct 2024 07:43:18 -0400 Subject: [PATCH] Add more value barriers to avoid compiler induced side channels The paper https://arxiv.org/pdf/2410.13489 claims that on specific architectures Clang and GCC may introduce jumps here. The donna128 issues only affect 32-bit processors, which explains why we would not see it in the x86-64 valgrind runs. The GHASH leak would seem to be generic but the authors only observed it on RISC-V. --- src/lib/utils/donna128.h | 5 +++-- src/lib/utils/ghash/ghash.cpp | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/src/lib/utils/donna128.h b/src/lib/utils/donna128.h index ff57190..1cbf060 100644 --- a/src/lib/utils/donna128.h +++ b/src/lib/utils/donna128.h @@ -8,6 +8,7 @@ #ifndef BOTAN_CURVE25519_DONNA128_H_ #define BOTAN_CURVE25519_DONNA128_H_ +#include #include namespace Botan { @@ -61,7 +62,7 @@ class donna128 final l += x.l; h += x.h; - const uint64_t carry = (l < x.l); + const uint64_t carry = CT::Mask::is_lt(l, x.l).if_set_return(1); h += carry; return *this; } @@ -69,7 +70,7 @@ class donna128 final donna128& operator+=(uint64_t x) { l += x; - const uint64_t carry = (l < x); + const uint64_t carry = CT::Mask::is_lt(l, x).if_set_return(1); h += carry; return *this; } diff --git a/src/lib/utils/ghash/ghash.cpp b/src/lib/utils/ghash/ghash.cpp index e24f5e0..8f0afa7 100644 --- a/src/lib/utils/ghash/ghash.cpp +++ b/src/lib/utils/ghash/ghash.cpp @@ -139,7 +139,7 @@ void GHASH::key_schedule(const uint8_t key[], size_t length) m_HM[4*j+2*i+1] = H1; // GCM's bit ops are reversed so we carry out of the bottom - const uint64_t carry = R * (H1 & 1); + const uint64_t carry = CT::Mask::expand(H1 & 1).if_set_return(R); H1 = (H1 >> 1) | (H0 << 63); H0 = (H0 >> 1) ^ carry; } -- 2.33.0