search

RustCrypto / KEMs

Collection of Key Encapsulation Mechanisms written in pure Rust
24 stars 12 forks source link

Evaluate whether compilation introduces a secret-dependent branch #25

Open bifurcation opened 4 months ago

bifurcation commented 4 months ago

The Kyber reference implementation has a vulnerability resulting from clang introducing a secret-dependent branch. The affected function there is poly_frommsg. The analogous function in our ML-KEM implementation is Encode::<U1>::decode. We should make sure that Rust compilation does not introduce secret-dependent branches.

bifurcation commented 4 months ago

I mocked this up in Godbolt and on a quick skim, I don't see any branching instructions. So maybe we're OK here. Would appreciate review by someone else, though.

tarcieri commented 4 months ago

Perhaps the subtle or cmov crates could be helpful?