Robust Constant-Time Cryptography
summary
Defines an operational semantics and a new property Robust Constant Time (RCT) that is parameterized by attacker models (read gadgets, speculative read gadgets, concurrent observers), and implements a compiler, RoboCop compiler, that synthesizes bespoke crypto libraries on LLVM/clang. Secrets live in protected memory with a protected stack, fenced boundaries for speculation, and Intel MPK for thread-local isolation. Evaluation on ~500 primitives shows median overhead 0.13%, 75% under 2% for readonly protections and under 4% for speculative protections.
AI-written summary · about
chapters (7)
- 0:00Robust constant-time crypto intro
- 1:45Classic constant-time limits
- 3:54Robust constant-time security
- 7:00Speculative execution attacks
- 9:30Robust constant-time compiler
- 11:58Performance overhead & deployment
- 12:20Q&A: threat models
related talks
23mRobust Constant-Time Cryptography
58mFast Cryptographic Code via Partial Evaluation
21mWhen Obfuscations Preserve Cryptographic Constant-Time
32mVerifying Constant-Time Implementations
37mFrontiers in Cryptography
08mShort Talk: Generalising secure compilation criteria
33mInteraction Preserving Compilers for Secure Computation
14mProtecting cryptography code from timing vulnerabilities