Constant-time programming keeps cryptographic work on the same execution path regardless of secret input. Avoiding secret-dependent branches helps resist timing, cache, and simple power-analysis attacks. section 13.4.1 section 13.5
Practical patterns include:
- Compare authentication tags by XORing corresponding bytes and accumulating the differences with OR, then check the final result. section 13.4.1
- Use algorithms that always perform both alternatives, such as Montgomery’s ladder or RSA square-and-multiply-always. section 13.4.1
- Avoid memory accesses that depend on secret data, not only conditional branches. section 13.5
Listing 13.1 How Golang implements a constant-time comparison between two bytearrays
func ConstantTimeCompare(x, y []byte) byte {
if len(x) != len(y) { #1
return 0 #1
} #1
var v byte #2
for i := 0; i < len(x); i++ { #2
v |= x[i] ^ y[i] #2
} #2
return v #3
}
A small Go comparison routine makes the XOR-and-OR accumulation pattern concrete. section 13.4.1
