In Cryptography Engineering Ferguson, Schneier and Kohno put a big emphasis on quality of code in order to prevent it from leaking information and from being vulnerable to memory corruption exploits.

Re-implementing cryptography, especially when open source libraries are already available, widely used and scrutinized; is usually said to be a recipe for disaster, but some times serious vulnerabilities are found on those. As a result some projects aim to simplify and clean them from bad and unused code to reduce the attack surface. Also, thanks to its aim to make it hard for programmers to write vulnerable code, rewriting some algorithms or protocols in Rust could also seem like a good idea.

However, even if top programmers with an ideal cryptography background manage to write perfect code, compilers in their default state still have a slight tendency to take instructions as suggestions rather than orders in the name of optimization and security.

Now, my doubts are the following:

  • What kinds of information leaks and side-channels could be caused by compilers alone?
  • What specific compiler features cause them and must be switched off to prevent them?

And, most importantly:

  • How can one check the resulting binaries accurately to make sure those side-channels and leaks are not present?
  • 1
    Dead code elimination: Efficient function/algorithm/method to do modular exponentiation. Also, see BearSLL constant time. Carefully look at the compiled code, and usually write it in assembly. – kelalaka Oct 29 '20 at 23:02
  • 1
    Another example Constant time multiplication in GF(2^8) – kelalaka Oct 29 '20 at 23:17
  • 1
    Amazing question! Though I fear that to answer it properly would require a full thesis. – Mike Ounsworth Oct 30 '20 at 0:53
  • In BearSSL's docs provided by @kelalaka there's an interesting link to the "Crypto Coding Standard" repository maintained by Dr. Aumasson. Apparently compilers are also a concern there, but the solution approach is no other than gaming them by rewriting esoteric bitwise-based best-effort constant-time equivalent functions and reverse-engineering the resulting binaries manually while simultaneously reciting prayers for different religions... – Albert Gomà Oct 31 '20 at 2:50
  • @MikeOunsworth Thanks! The doubts arised after seeing that in Rust, unlike in other languages, dependencies' source code is downloaded and compiled locally (which in most occasions can be preferable to blindly trusting a maintainer's binaries). I was aware of timing attacks, but I preferred to keep the questions open and generic in case other leaks are missing. Surprisingly to me, some Rust crates that claim to run in constant-time have no related compiler flags and passed an audit. – Albert Gomà Oct 31 '20 at 4:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.