Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Wed, 25 Jan 2023 11:34:43 -0800
From: Eric Biggers <>
Subject: Data operand dependent timing on Intel and Arm CPUs


I'd like to draw people's attention to the fact that on recent Intel and Arm
CPUs, by default the execution time of instructions may depend on the data
values operated on.  This even includes instructions like additions, XORs, and
AES instructions, that are traditionally assumed to be constant-time with
respect to the data values operated on.

For details, see the documents from each CPU vendor:


... as well as the following discussion on the Linux Kernel Mailing List:

Non-constant-time instructions break cryptographic code that relies on
constant-time code to prevent timing attacks on cryptographic keys -- i.e., most
cryptographic code.  This issue may also have a wider impact on the ability of
operating systems to protect data from unprivileged processes.

For Intel, processors with Ice Lake and later are affected by this issue.

The fix for this issue is to set a CPU flag that restores the old, correct
behavior of data-independent timing: DIT on Arm, and DOITM on Intel.

Linux v6.2 will enable DIT on Arm, but only in the kernel.  Without any
additional patches, userspace code will still get data-dependent timing by
default.  See

No patch has been merged to enable DOITM on Intel processors.  Thus, as-is, it's
not really possible to safely execute cryptographic algorithms on Linux systems
that use an Intel processor with Ice Lake or later.  (I'd guess that the same is
true for other operating systems too; Linux is just the one I'm looking at.)  To
fix this issue, I've proposed a Linux kernel patch that enables DOITM globally:

I consider this issue to be a CPU security vulnerability; it shares many
characteristics with other CPU security vulnerabilities such as Meltdown and
Spectre.  However, Intel and Arm do not seem to consider it to be a security
vulnerability.  No CVEs seem to have been assigned yet.

- Eric

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.