Please document what constant-time guarantees this crate provides about curve25519-dalek HOT 5 CLOSED

Hi, we already have a description of the safety guarantees in a branch (part of the pre-1.0 work we're doing), it's just not merged yet. I'll close this issue when those changes get merged into the develop branch.

Use of the nightly feature only adds additional safeguards that are only possible using Rust; without it, we get exactly the same properties as are available to C implementations. So while the nightly feature is recommended, it is not required to achieve the same properties as an alternative implementation written in C.

from curve25519-dalek.

@hdevalence From what I can tell, it looked like the nightly feature in subtle is (currently) required to prevent the optimizer from breaking the constant-time guarantees, in the same way that C can achieve through things like volatile or passing through an asm block just like Rust can. Have I missed something in subtle in that regard?

In any case, I appreciate and anticipate the future documentation from the branch. :)

from curve25519-dalek.

The nightly feature adds an extra guard that's aimed at preventing the compiler from having enough information to prove that a certain branch-adding optimization would be equivalent, so that the optimizer should not be able to apply that optimization.

Not having this guard doesn't mean that the optimizer breaks the code, it just means that it could be possible for a future compiler to infer more information about the values of some temporary variables, which could allow it to prove that inserting a branch would be equivalent to the code we wrote.

However none of that happens anyways -- the guard is an extra precaution that doesn't meaningfully change the generated code, aside from name mangling and the choice of backend for the clear_on_drop implementation.

from curve25519-dalek.

In #162 @hdevalence documented more w.r.t. constant-time guarantees, but if anything is still unclear please feel welcome to re-raise this issue.

from curve25519-dalek.

Those changes cover it, thank you!

from curve25519-dalek.