Side-Channel Mitigation Reference
Reference for mitigating timing, cache, power, and EM side-channels in cryptographic code.
Constant-Time Programming
Constant-time code eliminates all secret-dependent control flow and memory access. Use bitwise operations instead of branches for conditional selection. Avoid table lookups indexed by secret data (use bitsliced or arithmetic implementations). Compare buffers in constant time (CRYPTO_memcmp, timingSafeEqual). Masking splits secrets into random shares so power traces reveal nothing individually. Blinding randomizes inputs to defeat power analysis (RSA blinding, ECC scalar blinding).
- no branches
- Bitwise select
- no table lookup
- Bitsliced/ARX
- blinding
- Randomize inputs
cmov equivalentsecret-indexed tablesRSA/ECC blindingHardware and OS Mitigations
AES-NI and ARMv8 crypto instructions execute in constant time, avoiding cache-based table lookups. Intel CET and ARM BTI mitigate branch-target injection (Spectre v2). Speculative execution barriers (lfence, DSB) prevent Spectre-style leaks. Constant-time DRG and memory access patterns prevent cache timing. Power analysis countermeasures: hiding (random delays, shuffling), masking (secret sharing), and dual-rail logic. EM shielding reduces emanation leakage. FIPS 140 level 3+ requires tamper resistance.
- AES-NI
- HW constant-time
- Spectre
- Speculation barriers
- power
- Hiding + masking
no table lookuplfence, DSBrandom delays