liveBook · Manning

Variable-length loop

As explained in Hacking Cryptography

A variable-length loop is an iterative control-flow construct whose iteration count depends on runtime data.

A variable-length loop is an iterative construct whose iteration count depends on runtime data. In cryptographic code, controlling that count with secret or user-controlled data can expose information through timing and related side channels. section 10.5

The danger is control flow that reveals sensitive values indirectly. OpenSSL 0.9.8o’s elliptic-curve Montgomery ladder leaked how many leading bits of an ECDSA nonce were zero; enough signatures enabled a lattice attack to recover the nonce and private key. section 10.5

Use these implementation rules:

  • Avoid iteration bounds derived from secrets or user-controlled data. section 10.5
  • Make unavoidable loops execute the same number of times, including when errors occur. section 10.5
  • Where appropriate, replace loops with fixed operations or manually unrolled comparisons, accepting possible performance costs. section 10.5

How Hacking Cryptography covers it

How deep it goes
Connects the pattern to a concrete nonce-leakage attack and prescribes fixed-count alternatives, without developing attack mathematics.
Examples
Uses OpenSSL 0.9.8o’s Montgomery ladder and fixed-operation loop unrolling as contrasting implementation examples.
What you can do after
Apply fixed-count loops or fixed operations when implementing cryptographic routines with sensitive inputs.
How it connects
Ties variable-length loops to branching, timing attacks, speculative execution, Montgomery ladders, ECDSA nonces, and lattice attacks.
Cover of Hacking Cryptography
liveBookmanning.com
Read Hacking Cryptography on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Hacking Cryptography. The section links point to the parts of the book it draws on.