Pure-Rust traits and utilities for constant-time cryptographic implementations.
It consists of a
Choice type, and a collection of traits using
bool which are intended to execute in constant-time. The
type is a wrapper around a
u8 that holds a
This crate represents a “best-effort” attempt, since side-channels are ultimately a property of a deployed cryptographic system including the hardware it runs on, not just of software.
The traits are implemented using bitwise operations, and should execute in constant time provided that a) the bitwise operations are constant-time and b) the operations are not optimized into a branch.
To prevent the latter possibility, the crate attempts to hide the value of a
u8 from the optimizer, by passing it through either an
inline assembly block or a volatile read. For more information, see the
About section below.
[dependencies.subtle] version = "2.2"
Versions prior to
2.2 recommended use of the
nightly feature to enable an
optimization barrier; this is not required in versions
2.2 and above.
Documentation is available here.
This library aims to be the Rust equivalent of Go’s
The optimization barrier in
impl From<u8> for Choice was based on Tim
Maclean's work on
rust-timing-shield, which attempts to
provide a more comprehensive approach for preventing software side-channels in
subtle is authored by isis agora lovecruft and Henry de Valence.
This code is a low-level library, intended for specific use-cases implementing cryptographic protocols. It represents a best-effort attempt to protect against some software side-channels. Because side-channel resistance is not a property of software alone, but of software together with hardware, any such effort is fundamentally limited.
USE AT YOUR OWN RISK
Note that docs will only build on nightly Rust until RFC 1990 stabilizes.
A type which can be conditionally negated in constant time.
A type which can be conditionally selected in constant time.