Constant-time violations for div[u][w] and rem[u][w] #47
Description
Hi,
we have discovered that several instructions in OpenC910 (commit e0c4ad8) have data-dependent execution times, which could break the security assumptions of constant-time crypto code. The vulnerable instructions are as follows:
- div
- divu
- divw
- divuw
- rem
- remu
- remw
- remuw
The following depicts the traces for the div instruction for two different sets of inputs, resulting in different execution times.
Since the remaining instructions rely on the same execution unit, they are equally affected by this behaviour.
