@@ -51,20 +51,24 @@ static inline void cmov(uint8_t *r, const uint8_t *x, size_t len, uint8_t b)
5151 uint8_t opt_blocker ;
5252
5353 /*
54- * Goal: increment variable only depending on a given condition without
54+ * Goal: copy data only depending on a given condition without
5555 * the use of a branching operation which alters the timing behavior
5656 * depending on the condition. As the condition here depends on
57- * secret data (the buf variable) , the code has to ensure that no
58- * branching is used to have time-invariant code. This solution
59- * below also shall ensure that the compiler cannot optimize this code
60- * such that it brings back the branching.
57+ * secret data, the code has to ensure that no branching is used to have
58+ * time-invariant code. This solution below also shall ensure that the
59+ * compiler cannot optimize this code such that it brings back the
60+ * branching.
6161 *
6262 * (condition ^ opt_blocker) can be any value at run-time to the
6363 * compiler, making it impossible to skip the computation (except the
6464 * compiler would care to create a branch for opt_blocker to be either
6565 * 0 or 1, which would be extremely unlikely). Yet the volatile
6666 * variable has to be loaded only once at the beginning of the function
6767 * call.
68+ *
69+ * Note, the opt_blocker is not required in most instances, but in the
70+ * ARMv8 Neon implementation of SLH-DSA the compiler managed to still
71+ * create time-variant code without the optimization blocker.
6872 */
6973 opt_blocker = (uint8_t )optimization_blocker_int8 ;
7074
0 commit comments