Robust Constant-Time Cryptography
summary
Constant-time is insufficient: code that avoids secret-dependent branches still leaks when keys live in memory or the application misbehaves. The work defines robust constant time over library APIs by quantifying over attacker models—memory-unsafe, read-only attacker, and speculative—and proves rules: place keys in protected memory, toggle protections around library calls, keep functions constant-time, and clear temporaries (memzero fails under Spectre). A parameterized compiler inserts protections for the chosen attacker class and a speculative semantics models Spectre as an oracle.
AI-written summary · about
chapters (10)
- 0:00Robust constant-time crypto intro
- 2:28Constant time is insufficient
- 4:58Real-world crypto memory issues
- 7:46Robust constant-time model
- 10:34Robust constant-time definitions
- 11:59Spectre and its impact
- 14:47Speculative CT rules
- 16:11CT compiler approach
- 17:13Conclusion and future
- 18:00Q&A thread safety
related talks
17mRobust Constant-Time Cryptography
23mSmooth, Integrated Proofs of Cryptographic Constant Time for Nondeterministic Programs(…)
18mPreservation of speculative constant-time by compilation
18mPreservation of Speculative Constant-time by Compilation
14mProtecting cryptography code from timing vulnerabilities
32mVerifying Constant-Time Implementations
21mWhen Obfuscations Preserve Cryptographic Constant-Time
24mA CompCert Compiler that Preserves Cryptographic Constant-time