Search papers, labs, and topics across Lattice.
This paper systematizes the concept of constant time programming patterns, highlighting discrepancies between academic and industry interpretations of what constitutes "constant time." It identifies a critical gap between the protective capabilities of existing models and the assumptions made in specifications, leading to the development of a novel offensive methodology for uncovering timing vulnerabilities beyond the cryptographic primitives. The authors apply this methodology to reveal a significant specification-level vulnerability in private key loading, demonstrating that BoringSSL exhibits a much stronger signal than OpenSSL, despite its stricter threat model.
BoringSSL's timing vulnerabilities are alarmingly more pronounced than OpenSSL's, challenging assumptions about stricter security models.
Constant time programming patterns is the primary defense against timing attacks on cryptographic implementations, yet what"constant time"means varies across academia and industry. This work systematizes constant time models and their evolution, identifies a recurring gap between what models protect and what specifications assume, and distills an offensive methodology for discovering timing vulnerabilities that originate outside the cryptographic primitive boundary. Applying this methodology, we locate a specification-level vulnerability related to private key loading, and confirm the leak in both OpenSSL and BoringSSL. Counterintuitively, BoringSSL's per-observation signal is several orders of magnitude stronger than OpenSSL's, despite an explicitly stricter threat model.
