The microblog: 2022.08.22 19:17:26

2022.08.22 19:17:26 (1561764497143894016) from Daniel J. Bernstein, replying to "nikita borisov (@nikitab)" (1561699662368849921):

No, "specific data values may delay instruction retirement by, at most, one cycle" in is a pipeline effect. Also says Skylake "may" do this for "at least" one insn in a list of (basically) vector mul. CacheBleed showed exploitability of 1-cycle variations.

2022.08.22 19:22:24 (1561765744794251264) from Daniel J. Bernstein:

This is reminiscent of the FPU on the IBM PowerPC RS64 IV taking an extra cycle to multiply by 0; see warning at the bottom of page 10 of Figuring out values that trigger a Skylake slowdown could enable attacks along the lines of

2022.08.22 19:31:09 (1561767946870878209) from Daniel J. Bernstein:

It's easy to see how cutting corners in hardware for floating-point normalization would explain the slowdown on that PowerPC. Intel seems to say that its vector fp mul _is_ constant-time; but maybe the way that the vector int mul reuses the vector fp mul is creating a slowdown.


2022.08.21 17:27:05 (1561374336014901249) from "Adam Langley (@agl__)", replying to "Adam Langley (@agl__)" (1561374334714671104):

Ice Lake was released in 2019 but this information is only a few months old. So hopefully multiplication etc actually is always constant-time on existing chips and this is just preparing for the future?

2022.08.22 11:28:03 (1561646369814634497) from Daniel J. Bernstein:

The documentation actually suggests, but doesn't quite say, that, already on Skylake, vector multiplications (used in many crypto implementations) _aren't_ constant-time. Since then I've been doing various scans to try to find inputs triggering variations; nothing to report yet.

2022.08.22 14:41:04 (1561694947048247296) from "Brian Smith (@BRIAN_____)":

Perhaps the values affect the power consumption substantially which then triggers the power/heat throttling. I.e. timing side channel indirectly through power side channel.

2022.08.22 14:59:49 (1561699662368849921) from "nikita borisov (@nikitab)", replying to "Brian Smith (@BRIAN_____)" (1561694947048247296):

A la