Live data from Hacker News

Rolling your own crypto: Everything you need to build AES from scratch

github.com

91–92 of 92 posts

Re: Rolling your own crypto: Everything you need to build AES from scratch

#91
post #35

Earlier quoted context omitted.

Isn't table lookup constant time?

No. At least not with modern caching (or very old page boundary crossings). A constant time implementation has to avoid tables & compute the values directly (and slowly) or take special care to ensure that all of the table is hit/cached on each access.

> or take special care to ensure that all of the table is hit/cached on each access.

For example, by using an oblivious read: Access each row, AND it with a mask that is either all 1s or all 0s depending on if its the row you want (which you must set without branching) and OR all the results together.

Very slow.

Re: Rolling your own crypto: Everything you need to build AES from scratch

#92

Earlier quoted context omitted.

I guess the advice to "not roll your own crypto" can be safely considered compromised and hostile, especially after it came out that the winning curves in some competitions were selected by the NSA. Do roll your own crypto if you have nation state actors as potential attackers. Make life hard for them.

The point is that you probably make their life easier by rolling your own crypto.

Imagine a NSA Codebase, having to hold a million hacks for a million different moving targets, they would grind to a total halt. Implementation variety is defense by burdening the attacker with maintenance for a million little ecosystems.
Post reply on HN