TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

Bitslicing for Constant Time Cryptography (2020)

24 pointsby rdpintqogeogsaaover 3 years ago

4 comments

jedisct1over 3 years ago
Fixslicing is a slightly different technique that is a little bit faster: <a href="https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2020&#x2F;1123.pdf" rel="nofollow">https:&#x2F;&#x2F;eprint.iacr.org&#x2F;2020&#x2F;1123.pdf</a><p>Bitsliced&#x2F;fixsliced AES remains painfully slow compared to lookup-based AES, but also to ciphers that can easily be implemented without side channels to start with.<p>So, my recommendation would be:<p>- Do you have hardware-accelerated, side-channels free AES? Go use it.<p>- Are side channels part of your threat model? Do you think they are practical in the context of your application? (for the vast majority of cases, the honest answer is: they aren&#x27;t) If this is the case, do <i>NOT</i> use AES or anything that would require bitslicing&#x2F;fixslicing to be safe. ChaCha20 is likely to perform way better on that platform. Not to mention more recent alternatives.<p>- They are not? For some reason, you still want to use AES? Use a table-based implementation and don&#x27;t worry about it. Yes, this is fine.<p>Don&#x27;t take it the wrong way. Bitslicing&#x2F;fixslicing are excellent mitigation against side channels. But AES+bitslicing shouldn&#x27;t be your go to choice.
adg001over 3 years ago
Those of us interested in bitslicing may want to check out my – now 10 years old – pedagogical bitsliced implementation of the TEA block cipher.<p><a href="https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20110813104823&#x2F;http:&#x2F;&#x2F;plaintext.crypto.lo.gy&#x2F;article&#x2F;378&#x2F;untwisted-bit-sliced-tea-time" rel="nofollow">https:&#x2F;&#x2F;web.archive.org&#x2F;web&#x2F;20110813104823&#x2F;http:&#x2F;&#x2F;plaintext....</a><p>Code here: <a href="https:&#x2F;&#x2F;github.com&#x2F;secYOUre&#x2F;bstea" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;secYOUre&#x2F;bstea</a>
anonymousDanover 3 years ago
Anyone know of equivalent bitsliced MAC&#x2F;cryptographic hash algorithms (or resources describing how that might work)? Also, am I right in saying the implementations described in the article are effectively &#x27;CPU only&#x27;, i.e. no memory accesses are performed beyond the initial loading of the input data into registers and writing the final result?
评论 #29076710 未加载
ncmncmover 3 years ago
I think it was Emilia Käsper who was the first to do this. That was back when we didn&#x27;t have any built-in AES instructions.