RE: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Do you have any comment from Intel on the concerns regarding the scattering technique (http://cryptojedi.org/peter/data/chesrump-20130822.pdf)? First, a comment: it is difficult to actually understand the precise claim by the authors, from these 6 slides. The code snippet does not

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Do you have any comment from Intel on the concerns regarding the scattering technique (http://cryptojedi.org/peter/data/chesrump-20130822.pdf)? As discussed off-list in this case the discrepancy is because so called memory disambiguation logic attempting to move loads ahead of stores, and

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Not sent to RT, to openssl-dev only. Alternatives would be (a) using a new lock for safe static initialization, or (b) more code duplication to avoid the need for an explicit pointer (there could be two separate implementations for the higher-level routines). However, given the 1% performance

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Here is an updated version of the patch. Addressing a) pointer to the function (to select ADCX/ADOX) and b) multiple points addition There is (only) ~1% performance deterioration in due to the pointer being passed now, instead of (originally) being static. You can choose which style is

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

On Fri, Nov 8, 2013 at 4:08 AM, Bodo Moeller via RT r...@openssl.org wrote: Alternatives would be (a) using a new lock for safe static initialization, Maybe you could try my patches on my thread_safety branch of my github clone of OpenSSL? (https://github.com/nicowilliams/openssl) Nico --

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Here is an updated version of the patch. Addressing a) pointer to the function (to select ADCX/ADOX) and b) multiple points addition There is (only) ~1% performance deterioration in due to the pointer being passed now, instead of (originally) being static. You can choose which style is

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

On Fri, Nov 8, 2013 at 2:43 PM, Andy Polyakov via RT r...@openssl.org wrote: Alternatives would be (a) using a new lock for safe static initialization, or (b) more code duplication to avoid the need for an explicit pointer (there could be two separate implementations for the higher-level

Re: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

While if (functiona==NULL || functionb==NULL) { asssign functiona, functionb } can be unsafe, I'd argue that if (functiona==NULL) { assign functiona } followed by if (functionb) { assign functionb } is. We're implicitly assuming here that (thanks to alignment, etc.) each pointer can be

RE: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Thanks you Bodo, for the comments. Here are some quick answers It seems that the BN_MONT_CTX-related code The optimization made for the computation of the modular inverse in the ECDSA sigh, is using const-time mod-exp. Indeed, this is independent of the rest of the patch, and it can be used

RE: [openssl.org #3149] [patch] Fast and side channel protected implementation of the NIST P-256 Elliptic Curve, for x86-64 platforms

Thanks you Bodo, for the comments. Here are some quick answers It seems that the BN_MONT_CTX-related code The optimization made for the computation of the modular inverse in the ECDSA sigh, is using const-time mod-exp. Indeed, this is independent of the rest of the patch, and it can be used