For mpi_invm implementation, computation time should be fixed time.
Description
Description
Revisions and Commits
Revisions and Commits
| rC libgcrypt | |||
| rC90b7339b0654 mpi: Constant time mpi_inv with some conditions. | |||
| rC3a16c19d4d63 DSA,ECDSA: Fix use of mpi_invm. | |||
| rCada758e3019c DSA,ECDSA: Fix use of mpi_invm. | |||
| rC20082ca965ea mpi: Constant time mpi_inv with some conditions. | |||
| Status | Assigned | Task | ||
|---|---|---|---|---|
| Resolved | • gniibe | T4869 constant-time mpi_invm | ||
| Resolved | • werner | T4294 Release Libgcrypt 1.9.0 |
Event Timeline
Comment Actions
Related the changes, before we did the changes, we received two independent reports.
For one, the reference is: https://arxiv.org/pdf/2002.08437.pdf
Comment Actions
I tested with this patch (which changes use of constant-time routine when it's secure memory):
build-amd64/libgcrypt/tests$ ./benchmark mpi-invm invm-generic 1210ms 1060ms 870ms 2010ms 2010ms 950ms invm-ct 370ms 360ms 370ms 1030ms 1030ms 1080ms
My opinion is that it's OK not to introduce the check if it's on secure memory or not.