Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Optimize HACL* Raw RSA Encryption to use non-constant-time operations. #460

Open
franziskuskiefer opened this issue Apr 24, 2024 · 8 comments
Assignees

Comments

@franziskuskiefer
Copy link
Member

No description provided.

@franziskuskiefer
Copy link
Member Author

PR coming for HACL this week.

@karthikbhargavan
Copy link
Collaborator

Did not manage to get this done last week. This week is the target (for sure this time!)

@karthikbhargavan
Copy link
Collaborator

Finally made good progress on this, after many disproved hypotheses.
Now, we have a 2-3x perf improvement.

@karthikbhargavan
Copy link
Collaborator

Made the modifications, now looking into CRT decryption before sending to CF

@karthikbhargavan
Copy link
Collaborator

Tested on multiple platforms and compilers.

Some observations:

  • compiling with gcc on x64 does not appear to enable HACL_CAN_COMPILE_INTRINSICS in lib_intrinsics.h, leading to a performance degradation. enabling this flag provides a significant boos.
  • optimizing at -O2 (like the Linux Kernel) vs -O3 does not make much difference to this code
  • recent GCCs (e.g. 13) are better at optimizing this code than GCC-11
  • recent clang is still about 10-15% faster than recent GCC
  • the optimizations that work differ for x64 and ARM likely because of the difference in mul instructions and pipelining
  • with targeted optimizations for ARM our enc code is within 10-20% of optimized OpenSSL assembly on M1 Max
  • with intrinsics for x64, our code is within 75-90% of optimized OpenSSL on core i7

@karthikbhargavan
Copy link
Collaborator

Next steps: Send update to CF by June 5th on status and plans.

@franziskuskiefer
Copy link
Member Author

Next steps: push upstream to HACL and to consumers

@karthikbhargavan
Copy link
Collaborator

This will only get done later in August, after ML-KEM proofs are in shape.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
Status: Triage Needed
Development

No branches or pull requests

2 participants