Constant-Time Crypto
Definition
An implementation whose execution time, memory access pattern and power profile do not depend on the secret key or plaintext. The defence against timing, cache and power side channels. AES-NI is constant-time by hardware design; software AES with T-tables is not.
- Field
- Symmetric cryptosystem implementation
- Defends against
- Timing, cache, and power side channels
- Hardware example
- AES-NI is constant-time by design
- Vulnerable example
- Software AES using T-tables
Common questions
Why does a T-table AES implementation leak the key through timing?+
T-tables are lookup tables indexed by intermediate cipher values that depend on the secret key, and CPU cache access time differs depending on whether a value is cached, so an attacker who measures execution time or cache state across many operations can infer which table entries were accessed and recover key bits.
Why does a forensic examiner care whether an encryption implementation is constant-time?+
A non-constant-time implementation can sometimes be attacked to recover keys without ever obtaining the plaintext or the key file directly, which matters when assessing whether an encrypted device or container was realistically breakable by a given adversary, or when evaluating a vendor's claim of security.
Related terms
- AEAD
- Authenticated Encryption with Associated Data. Combines confidentiality and integrity in one primitive. AES-GCM and ChaCha20-Poly1305 are the two modern standards. TLS 1.3...
- AES-NI
- AES New Instructions: hardware AES acceleration introduced on Intel Westmere (2010) and AMD Bulldozer (2011) and now ubiquitous. Single-cycle round operations make...
- Block Cipher
- A symmetric cipher that operates on fixed-size blocks (typically 64 or 128 bits) under a key. AES is a 128-bit-block cipher; DES...
- Mode of Operation
- The wrapping protocol that defines how a block cipher handles arbitrary-length data, what IV or nonce is used, and whether integrity is...
- Stream Cipher
- A symmetric cipher that produces a pseudo-random keystream which is XORed bit-by-bit or byte-by-byte with the plaintext. RC4 (legacy), ChaCha20 (current). Stream...