Side-Channel Attack Mitigations in Rustls about rustls HOT 2 CLOSED

Maybe we should update the README and documentation to make it clearer that we rely on other crates for crypto? In general reviewing the README with fresh eyes I feel like "Stability" is not the thing we should mention first.

from rustls.

rustls is an implementation of the TLS protocol. It does not implement the underlying cryptography itself, so your question about constant-time cryptography is best asked of other projects. However, there are some instances in the TLS protocol where public and private quantities need to be tested for equality: for these we use the subtle crate.

I am not aware that NIST publish any guidelines or documents on mitigating side-channel attacks -- their position generally is one "SHOULD resist relevant side-channel (e.g., timing and power-consumption analysis) attacks" (but without precisely defining the meaning of "resist", or how to determine which are "relevant"!) If I'm wrong please reference the specific standard or special publication.

from rustls.