I guess people are just going to keep discovering that you can't really make a C compiler do constant time
-
"Can it be fair to require the average programmer to understand inline assembly, or any of these other inherently obtuse obfuscation techniques?"
can it be fair for the average programmer (if they don't understand this stuff) to just not write code where timing channels matter? who even writes these articles
@regehr even the best programmers in the world struggle with this kind of stuff, ffs...
-
-
-
well, if the problems are important enough, something like this:
https://discourse.llvm.org/t/rfc-constant-time-coding-support/87781
-
I guess people are just going to keep discovering that you can't really make a C compiler do constant time
https://www.theregister.com/2026/02/09/compilers_undermine_encryption/
@regehr all I will say to that is eyup
-
@rygorous @pervognsen aw, look at all the little nans and infs flying and being free!!!
-
@kaoudis I've not been paying too much attention to the LLVM effort-- anything interesting going on there? or should I just dig into the discourse?
-
@rygorous @pervognsen aw, look at all the little nans and infs flying and being free!!!
-
@kaoudis I've not been paying too much attention to the LLVM effort-- anything interesting going on there? or should I just dig into the discourse?
@regehr I think* @wizardengineer landed the first bits of that work!
*I left trail of bits voluntarily (and for reasons unrelated) a bit before this happened though
-
-
@regehr I think* @wizardengineer landed the first bits of that work!
*I left trail of bits voluntarily (and for reasons unrelated) a bit before this happened though
@kaoudis @wizardengineer ah! I don't think I knew that. where are you at right now?
-
-
I guess people are just going to keep discovering that you can't really make a C compiler do constant time
https://www.theregister.com/2026/02/09/compilers_undermine_encryption/
@regehr Maybe it's time to write new assemblers that complement NASM*.
* Or MASM; I wish NASM had an invoke keyword, like MASM, to abstract away calling conventions. Rather than writing a macro for it.
-
-
@kaoudis @wizardengineer ah! I don't think I knew that. where are you at right now?
@regehr @wizardengineer Strava! I’m doing appsec over there
-
@regehr @wizardengineer Strava! I’m doing appsec over there
@kaoudis @wizardengineer awesome!
-
I guess people are just going to keep discovering that you can't really make a C compiler do constant time
https://www.theregister.com/2026/02/09/compilers_undermine_encryption/
@regehr yes you can, unless you care about correct results too.
-
I guess people are just going to keep discovering that you can't really make a C compiler do constant time
https://www.theregister.com/2026/02/09/compilers_undermine_encryption/
@regehr "The user types in a password, which gets checked against a database, character by character"
Seriously? That is how they think it works?
-
R ActivityRelay shared this topic