Re: [PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-19 Thread Ard Biesheuvel
On 20 October 2018 at 04:39, Eric Biggers wrote: > On Fri, Oct 19, 2018 at 05:54:12PM +0800, Ard Biesheuvel wrote: >> On 19 October 2018 at 13:41, Ard Biesheuvel >> wrote: >> > On 18 October 2018 at 12:37, Eric Biggers wrote: >> >> From: Eric Biggers >> >> >> >> Make the ARM scalar AES

Re: [PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-19 Thread Eric Biggers
On Fri, Oct 19, 2018 at 05:54:12PM +0800, Ard Biesheuvel wrote: > On 19 October 2018 at 13:41, Ard Biesheuvel wrote: > > On 18 October 2018 at 12:37, Eric Biggers wrote: > >> From: Eric Biggers > >> > >> Make the ARM scalar AES implementation closer to constant-time by > >> disabling interrupts

Re: [PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-19 Thread Eric Biggers
On Fri, Oct 19, 2018 at 01:41:35PM +0800, Ard Biesheuvel wrote: > On 18 October 2018 at 12:37, Eric Biggers wrote: > > From: Eric Biggers > > > > Make the ARM scalar AES implementation closer to constant-time by > > disabling interrupts and prefetching the tables into L1 cache. This is > >

Re: [PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-19 Thread Ard Biesheuvel
On 19 October 2018 at 13:41, Ard Biesheuvel wrote: > On 18 October 2018 at 12:37, Eric Biggers wrote: >> From: Eric Biggers >> >> Make the ARM scalar AES implementation closer to constant-time by >> disabling interrupts and prefetching the tables into L1 cache. This is >> feasible because due

Re: [PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-18 Thread Ard Biesheuvel
On 18 October 2018 at 12:37, Eric Biggers wrote: > From: Eric Biggers > > Make the ARM scalar AES implementation closer to constant-time by > disabling interrupts and prefetching the tables into L1 cache. This is > feasible because due to ARM's "free" rotations, the main tables are only > 1024

[PATCH v3 2/2] crypto: arm/aes - add some hardening against cache-timing attacks

2018-10-17 Thread Eric Biggers
From: Eric Biggers Make the ARM scalar AES implementation closer to constant-time by disabling interrupts and prefetching the tables into L1 cache. This is feasible because due to ARM's "free" rotations, the main tables are only 1024 bytes instead of the usual 4096 used by most AES