Bug 688 - Look through RISC-V cryptography extensions for ideas worth borrowing
Summary: Look through RISC-V cryptography extensions for ideas worth borrowing
Status: CONFIRMED
Alias: None
Product: Libre-SOC's first SoC
Classification: Unclassified
Component: Specification (show other bugs)
Version: unspecified
Hardware: Other Linux
: --- enhancement
Assignee: Luke Kenneth Casson Leighton
URL:
Depends on:
Blocks:
 
Reported: 2021-09-10 05:13 BST by Jacob Lifshay
Modified: 2021-09-10 11:08 BST (History)
1 user (show)

See Also:
NLnet milestone: ---
total budget (EUR) for completion of task and all subtasks: 0
budget (EUR) for this task, excluding subtasks' budget: 0
parent task for budget allocation:
child tasks for budget allocation:
The table of payments (in EUR) for this task; TOML format:


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Jacob Lifshay 2021-09-10 05:13:37 BST
https://github.com/riscv/riscv-crypto/releases

Particularly interesting:
* Zkt - Data Independent Execution Latency aka. "constant-time" -- exactly like what I've been saying we should do for years...we're most the way there already, we just need concerted effort to keep stuff from breaking rather than the current state of mostly being "constant-time" by accident.

one really important point that I want to ensure you, Luke, (and others) know, so I'll repeat it even though you probably already know it:
in crypto software/hardware, "constant time" doesn't literally mean "always runs in the same amount of time no matter what", instead it means "runtime doesn't depend on data", though it does depend on branch conditions, instruction fetching/address, and load/store addresses (it does not depend on load/store data for normal memory).

The RISC-V spec draft linked above states:
> The Zkt extension attests that the machine has data-independent
> execution time for a safe subset of instructions. This property
> is commonly called "constant-time" although should not be taken
> with that literal meaning.

* Zbkx - Crossbar permutation instructions -- like register gather, but "constant-time"
* They used real executable Sail code as their specification pseudo-code
Comment 1 Luke Kenneth Casson Leighton 2021-09-10 11:08:40 BST
(In reply to Jacob Lifshay from comment #0)
> https://github.com/riscv/riscv-crypto/releases

> one really important point that I want to ensure you, Luke, (and others)
> know, so I'll repeat it even though you probably already know it:

i know exactly what is involved: i worked for Internet Security Systems,
i have done black-box Reverse-Engineering, analysed crytographic algorithms
for implementation on massive wide bit-level SIMD systems and developed
a cryptographic algorithm.

the amount of time and effort involved here must in NO WAY be underestimated.
it is a SERIOUS, SERIOUS amount of effort that will, if tackled *right now*,
ACTIVELY undermine and compromise our ability to deliver on the other
milestones that we have committed to deliver.

as i said already the last time this was discussed, if there are *other people*
who wish to tackle constant-time design, power analysis, or other aspects of
crytographic implementation and design, they are *more* than welcome to do
so.  i will even help them to write the requisite NLnet Grant application.

we however *CANNOT* blithely retro-fit such massive and fundamental design
strategies on top of *PRE-AGREED* NLnet milestones, particularly when we
are only around 15% of the way through the ones that we've already committed
to doing.

our agreements with NLnet have been vetted and approved by independent
third party audit, and CANNOT BE CHANGED.

if we decide without proper thought to tackle this additional massive and
highly intrusive design task *WE WILL NOT GET PAID FOR IT* under the existing
budgets.

please understand:

it's not about whether it's a good idea or not

it's not about whether it "makes things secure"

it's about GETTING PAID and about NOT taking on additional unpaid complex
tasks that jeapordise our existing responsibilities.

so.

if you believe this to be a good idea, and feel strongly about it,
then put together the NLnet Grant Proposal, and find the people
with the expertise to collaborate with and help implement the ideas.

you will need to give accurate time estimates on the tasks in order
to ensure that the budgets are adequate.

you will also need to ensure that it does not interfere with the other
responsibilities and obligations to complete NLnet Milestones.