Hertzbleed Attack

Agreed. Especially considering that the main threats are still good old social engineering and gullible users downloading and running malware.

Attack vectors like Hertzbleed require considerable resources, detailed knowledge about the target (in order to get the required preconditions right), and as others pointed out are easily detectable.

> Constant time" in cryptography means that there is no information flow from secrets to timings

If "constant time" cryptography were achievable don't you think we'd have it and there'd be no more timing attacks breaking encryption schemes?

"Constant time" cryptography is a mathematical abstraction, a goal, like "unbreakable cipher" and "unbreakable hash" and "frictionless surface." They don't occur in practice. This article breaks itself breaks a "constant time" cryptography with a timing attack.

The problem is, as this paper demonstrates (along with many others) coding up a constant time crypto and especially making it portable over time and architectures, is nearly impossible. Caches, chip nuances, power draw mixed with power scaling, and other chip architecture complexity, contribute to attacks. Compiler changes, architecture changes (some even unpublished), architecture variety, user settings, even flaws in any part of the chain, all contribute to making holes in crypto in the real world.

This paper [1], for example, is one of many that shows the "constant time" goal is likely not possible, and is certainly not possible in portable code.

Here's [2] a paper tying to make simple AES "timing-attack resistant" - and you note they did not claim they could make it "constant time" because they realize that is not possible. "Timing-attack resistant" is at least professionally defensible.

Here's [3] a paper referencing [2], trying to make systems more resistant to cross process leaks using Intel SGX to hide things that leaking.

And here [4] is the attack on Intel SGX that shows there are still exploitable leaks.

This type of chain is not unique.

If you want to read literally thousands of papers on such things use google scholar or surf the cryptology eprint archive. Both make searching on such topics pretty easy.

We could go on and on. The literature of crypto is littered with such threads - "constant time" crypto is the goal, but so is "unbreakable encryption" - both are mathematical fantasies that do not play out in practice.

[1] https://arxiv.org/pdf/1711.08002.pdf

[2] https://link.springer.com/chapter/10.1007/978-3-642-04138-9_...

[3] https://arxiv.org/pdf/1702.08719.pdf

[4] https://arstechnica.com/information-technology/2020/03/hacke...

How was cloudflare chosen over say linux foundation or red hat to disclose

The same government programs that funded almost all the initial research on semiconductors and early computers for the first 4 decades?

The programs who funded the research for telephones, lasers, aeronautics, satellites, CDs, fiber optics, GPS, GSM, LCDs using tax money?

I can imagine how little progress there would be if they didn't.

I think SIKE was just chosen because of its relevance, not because it has any particular issues that make it more susceptible. I'd be curious to hear from an expert on this.