If there is a portion of the frame where the cycle stealing doesn't occur, e.g. during vertical blanking, maybe you can schedule your multiplications to only happen there. It will not strictly be constant time of course, and it will be slower, but timing would be invariant of input. Timing characteristics would instead reveal to the attacker where the raster beam was when the calculation started :)
That’s a great idea but that takes away a lot of compute! I didn’t pursue this further since at that point we might as well do the adds vs muls.
I thought about calculating the worst case execution time by hand and than just doing a literal report solution on a timer after time has passed
The issue with that strategy is that I would like the OS to stay responsive (and there is interrupts that fall into that time frame) so could overshoot the budget and then we’re back to square zero.
I think at this point I probably have no choice other than unrolling it into addition :(
There is mitigations for those kind of things that make delta analysis impossible but I would REALLY just like the perfect solution that doesn’t depend on the secret for timing at all.
Comments
If there is a portion of the frame where the cycle stealing doesn't occur, e.g. during vertical blanking, maybe you can schedule your multiplications to only happen there. It will not strictly be constant time of course, and it will be slower, but timing would be invariant of input. Timing characteristics would instead reveal to the attacker where the raster beam was when the calculation started :)
That’s a great idea but that takes away a lot of compute! I didn’t pursue this further since at that point we might as well do the adds vs muls.
I thought about calculating the worst case execution time by hand and than just doing a literal report solution on a timer after time has passed
The issue with that strategy is that I would like the OS to stay responsive (and there is interrupts that fall into that time frame) so could overshoot the budget and then we’re back to square zero.
I think at this point I probably have no choice other than unrolling it into addition :(
There is mitigations for those kind of things that make delta analysis impossible but I would REALLY just like the perfect solution that doesn’t depend on the secret for timing at all.