Usuba: high-throughput and constant-time ciphers, by construction

Abstract

Cryptographic primitives are subject to diverging imperatives. Functional correctness and auditability pushes for the use of a high-level programming language. Performance and the threat of timing attacks push for using no more abstract than an assembler to exploit (or avoid!) the microarchitectural features of a given machine. We believe that a suitable programming language can reconcile both views and actually improve on the state of the art of both. Usuba is an opinionated dataflow programming language in which block ciphers become so simple as to be "obviously correct" and whose types document and enforce valid parallelization strategies at the granularity of individual bits. Its optimizing compiler, Usubac, produces high-throughput, constant-time implementations performing on par with hand-tuned reference implementations. The cornerstone of our approach is a systematization and generalization of bitslicing, an implementation trick frequently used by cryptographers. CCS Concepts• Software and its engineering → Domain specific languages; Data flow languages; • Security and privacy → Block and stream ciphers.

Tornado: Automatic Generation of Probing-Secure Masked Bitsliced Implementations

“…As part of future work, we intend to further enrich our compiler backend with optimizations specific to embedded architectures (Cortex M and/or Risc-V), systematizing various primitivespecific optimizations documented in the literature [35,28,33]. Previous results on Intel architecture [29] has demonstrated that Usuba can produce code whose performance is on par with hand-optimized, assembly implementations.…”

“…However, bitslicing can be generalized to n-slicing [29] (with n > 1). Whereas bitslicing splits an m-word quantity into m individual bits, we can also treat it at a coarser granularity 5 , splitting it into k variables of n bits each (preserving the invariant that m = k × n).…”

“…For example, it features a custom instruction scheduling algorithm, aimed at minimizing the register pressure of bitsliced code. On high-end Intel architectures featuring Single Instruction Multiple Data (SIMD) extensions, Usuba has demonstrated performance on par with hand-optimized reference implementations [29].…”

“…Besides, operating each loop (increment, comparison, branching) impedes an overhead that the C compiler is something heuristically willing to optimize out at small orders, leading to confusing threshold effects when benchmarking. To address both issues, we systematically perform loop fusion, thus obtaining for (int i=0; i<=MASKING_ORDER; i++) { A(i); B(i); C(i); } on the above example, followed by instruction scheduling, which will strive to reduce the live range [29] (and thus the number of temporaries) of, for example, the variables set in A and used in B.…”

“…In practice one could hope for an integrated tool that takes an input circuit in a simple syntax, determine where to place the refresh gadgets and compile the augmented circuit into a masked implementation, for a given masking order on a given computing platform. Usuba, introduced by Mercadier and Dagand in [29], is a highlevel programming language for specifying symmetric block ciphers. It provides an optimizing compiler that produces efficient bitsliced implementations.…”