SoK: The Constant Time Model
summary
Systematizes constant-time models and finds a specification-level timing bug in private key loading: ASN.1/DER integer canonicalization leads to shorter encodings that parse faster, exposed by a BN2BN length-dependent parse in real libraries. Measured across several thousand measurements for many key lengths, BoringSSL’s timing distributions are ≈100× stronger leak than OpenSSL’s and are statistically separable; a naive countermeasure (parallel dummy max-length parse) masks the signal and flattens the timing curve.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:14Constant time definition conflicts
- 3:43Tweaking constant time definitions
- 5:46Program counter security model
- 7:10Traditional constant time model
- 9:37Intel scatter-gather flaws
- 10:38OpenSSL’s constant time policy
- 12:26BoringSSL’s input model
- 13:29Vulnerabilities in specifications
- 14:52Elliptic curve key leak anatomy
- 18:24Timing differences in BoringSSL
- 20:51Timing leak mitigation
- 21:52Data over semantics
- 22:13Closing and takeaways
related talks
26mConstant-Time Callees with Variable-Time Callers
23mRobust Constant-Time Cryptography
14mProtecting cryptography code from timing vulnerabilities
50mTime Trial: Racing Towards Practical Timing Attacks
28mOne&Done: A Single-Decryption EM-Based Attack on OpenSSL’s Constant-Time Blinded RSA
53mOpenSSL Deep Dive: The Good, Bad And Not-So-Ugly
01h 02mCryptographic Side-Channels on Embedded Devices
24mA Decade After Bleichenbacher '06, RSA Signature Forgery Still Works