fix: constant-time modular arithmetic in interactive bootstrapping decrypt path#1211
Open
BAder82t wants to merge 1 commit into
Open
fix: constant-time modular arithmetic in interactive bootstrapping decrypt path#1211BAder82t wants to merge 1 commit into
BAder82t wants to merge 1 commit into
Conversation
…crypt path Closes openfheorg#1198. Adds CT variants of ModAddFastEq and ModMulFastConst used in PolynomialRound, which operates on cs = c[1]*s + c[0] — a polynomial that is directly secret-key-correlated. The original branching variants remain untouched for server-side hot paths (NTT, EvalMult, etc.). New utils/constanttime.h provides SubIfGE and AddIfNeg using the branchless mask idiom (no asm barriers, vectorisation preserved). NativeIntegerT gains ModAddFastEqCT and ModMulFastConstCT alongside the existing fast variants.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Closes #1198.
PolynomialRound(called fromIntBootDecrypt) operates oncs = c[1]*s + c[0]— a polynomial directly correlated to the secretkey. Its inner loop called
ModMulFastConstandModAddFastEqon eachcoefficient, both of which contain secret-dependent conditional branches
that are timing oracles.
This PR follows the architecture suggested when closing #1177: CT
variants are added alongside the originals and used only in the
sensitive decrypt path. All other callers — NTT butterfly, EvalMult,
server-side operations — remain on the original fast variants unchanged.
Changes
utils/constanttime.h—SubIfGEandAddIfNegbranchless primitives innamespace lbcrypto::ctubintnat.h—ModAddFastEqCTandModMulFastConstCTadded alongside originals; originals untouchedrns-multiparty.cpp—PolynomialRounduses CT variants (4 lines)Benchmarks (Apple M-series, clang -O3, 20M random inputs)
No regression. The mask idiom eliminates unpredictable branch penalties
without asm barriers, so vectorisation and scheduling are preserved.
2050/2050 tests pass.
Known limitation
CT guarantees do not hold on WASM (
__EMSCRIPTEN__). TheMultDfunction used inside
ModMulFastConstCTemulates 128-bit multiply insoftware with carry-detect branches that are data-dependent on every
multiply. Fixing this requires a branchless carry implementation and is
out of scope here; it is documented in
constanttime.h.