Add instrumented constant-time verification (dudect + ctgrind/Valgrind) - #164
Merged
Conversation
Measured-CT gate: paired constant-time subjects and known-leaky controls, the gate being "controls fire AND subjects clean". dudect (CTLeakDetect) covers the wNAF/tau-NAF/variable-time-inverse control-flow leaks; ctgrind/Valgrind (CTValgrind + ct_poison.c) covers the T-table AES / 4k GHASH memory-access leaks. All under CRYPTOLIB_FORCE_SCALAR. Valgrind leg wired into the linux-x64-scalar CI job (ci/valgrind-ct.sh, MAKE_RUN_CT_VALGRIND toggle).
Measured-CT gate under CryptoLib.ConstantTime/: constant-time subjects paired with known-leaky controls, the gate being "controls fire AND subjects clean", all under CRYPTOLIB_FORCE_SCALAR. dudect (CTLeakDetect) covers the wNAF / tau-NAF / variable-time-inverse control-flow leaks; ctgrind/Valgrind (CTValgrind + ct_poison.c) covers the T-table AES / 4k GHASH memory-access leaks. Valgrind leg wired as a CI gate in the linux-x64-scalar and linux-arm64-scalar jobs (native x86_64 + AArch64); MAKE_RUN_CT_VALGRIND toggle.
Add a `mod-inv (wrapper)` row measuring the exact signer call TBigIntegerUtilities.ModOddInverse(n, k) — the full TBigInteger wrapper, not just the safegcd core — with k in [1, n-1], fixed class n-1, allocation- symmetric prep, and only the call timed. Subject clean on both x86_64 cells, variable-time control fires: the nonce inverse is measured-CT end-to-end. Updates the README coverage matrix (aarch64 dudect open; macOS not pursued).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This PR adds a measured constant-time gate under
CryptoLib.ConstantTime/, pairing constant-time subjects with known-leaky controls. The gate passes only when every control fires and every subject stays clean — all underCRYPTOLIB_FORCE_SCALAR.Two independent verification legs
CTLeakDetect)|t| > 4.5)CTValgrind)ct_poison.cdudect subjects and controls
[d]Q: FixedWindow CT vs wNAF control[d]Q: F2m Montgomery CT vs WTauNAF controlTBigIntegerUtilities.ModOddInverse(n, k)vs variable-time wrapper — ECDSA nonce inverse measured end-to-endValgrind subjects and controls
x25519,aes-bitsliced,ghash-basicaes-ttable,ghash-4kNew components
ClpDudect.pas,ClpCtClock.pas,ClpCtSubjects.pas— shared subject registry and dudect enginect_poison.c— Valgrind taint shimCTLeakDetect/CTValgrindLazarus console programsCryptoLib.ConstantTime/README.md— coverage matrix, local run instructions, setup notesCI integration
.github/workflows/ci/valgrind-ct.sh— buildsCTValgrindagainst prebuilt scalar packages and runs the taint gatelinux-x64-scalarandlinux-arm64-scalarjobs (after standard build)MAKE_RUN_CT_VALGRINDtoggle (defaulttrue; setfalseto skip)