Time Constant Tests

[ram-singh-git]

Hello,

I had a query regarding algos being time constant in liboqs.
Are the algos tested for being time constant in liboqs ? if yes, what tests are done to validate this ?

Thanks in advance for your time.
Regards.

[dstebila]

liboqs uses the Valgrind ctgrind method to check for memory accesses and branching on secret data. You can see the test script at https://github.com/open-quantum-safe/liboqs/blob/main/tests/test_constant_time.py and the algorithm data sheets indicate which implementations are tested.

[ram-singh-git]

Thanks for your reply @dstebila

i see few issues and passes mentioned here : https://github.com/open-quantum-safe/liboqs/tree/main/tests/constant_time

do they represent functions that are not time constant ?

[dstebila]

Things in the "issues" and "passes" directory represent deviations from constant time behaviour. "passes" are things that have been inspected manually and are believed to not affect security -- for example, rejection sampling which does depend on the secret key but the information leaked from that timing channel will not open up a timing attack. "issues" are things where we do not have that confidence.