News for hackers. Stuff that matters.

A comment on Introducing Sodium, a new cryptographic library. Parent comment

Re:Introducing Sodium, a new cryptographic library by anologwintermut on Thursday March 07, 2013 @12:45AM (#5336325)
Judging from the context below and my limited knowledge of NaCL, this is incorrect. It uses the same algorithms but with the ASM removed. Since, I believe, one of the points of the ASM was removing timing attacks, removing it is not an inherently safe operation. Not saying anyone did anything wrong, just people should be careful and someone should probably check. This is not just a wrapper around NaCL.
[ Parent | on HN ]
Re:Introducing Sodium, a new cryptographic library by floody-berry on Thursday March 07, 2013 @01:24AM (#5336428)
The C versions (mostly reference implementations) in NaCl are constant time. The assembly code is there for performance.
[ Parent | on HN ]
Re:Introducing Sodium, a new cryptographic library by dietrichepp on Thursday March 07, 2013 @01:28AM (#5336437)
Well, maybe they are constant time today. But it is difficult to make wagers about the future of C compilers.
[ Parent | on HN ]
Re:Introducing Sodium, a new cryptographic library by floody-berry on Thursday March 07, 2013 @01:42PM (#5339317)
Everything that doesn't have assembler versions of all their constant time code (even NaCl under x86/x64) will be vulnerable then. It's possible that compilers start to "optimize" the branchless constructs, but it would almost be malicious as they extremely rare to ever encounter outside of specifically wanting not to branch.
[ Parent | on HN ]