Skip to content

Commit

Permalink
Merge bitcoin#630: Note intention of timing sidechannel freeness.
Browse files Browse the repository at this point in the history
8d1563b Note intention of timing sidechannel freeness. (Gregory Maxwell)

Pull request description:

  Resolves bitcoin#238

ACKs for commit 8d1563:

Tree-SHA512: 2b0ca945d70e5975291ed9a0884eddfd771fd06dfed37c9711f8b57d431c28b974e5a5d86ae6e70e5e37c5f208bcb74e9ab18fcf9d7b78849fcf3cff9ba7623b
  • Loading branch information
gmaxwell committed May 29, 2019
2 parents 1669bb2 + 8d1563b commit f34b0c3
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -45,8 +45,10 @@ Implementation details
* Optionally (off by default) use secp256k1's efficiently-computable endomorphism to split the P multiplicand into 2 half-sized ones.
* Point multiplication for signing
* Use a precomputed table of multiples of powers of 16 multiplied with the generator, so general multiplication becomes a series of additions.
* Access the table with branch-free conditional moves so memory access is uniform.
* No data-dependent branches
* Intended to be completely free of timing sidechannels for secret-key operations (on reasonable hardware/toolchains)
* Access the table with branch-free conditional moves so memory access is uniform.
* No data-dependent branches
* Optional runtime blinding which attempts to frustrate differential power analysis.
* The precomputed tables add and eventually subtract points for which no known scalar (private key) is known, preventing even an attacker with control over the private key used to control the data internally.

Build steps
Expand Down

0 comments on commit f34b0c3

Please sign in to comment.