PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Part 1: The life of an optimization barrier

blog.trailofbits.com | blog | #rust | #cryptography | #llvm | #constant-time | #side-channels | #webassembly
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Constant-time Rust cryptography can be broken by optimization. Compiling to WebAssembly means code passes through two optimizers, and LLVM itself may introduce a new timing side-channel.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Part 2: Improving crypto code in Rust using LLVM’s optnone
This post implements an optnone attribute in rustc so developers can disable optimizations for security-critical functions, examining the resulting LLVM IR and codegen pitfalls.
research · blog.quarkslab.com
llvm_dev_meeting:
Report from the 2015 LLVM Developer Meeting: Quarkslab's out-of-tree pass tutorial and a lightning talk on LLVM's limits, plus recaps of talks on WebAssembly, OpenCL and performance tracking.
research · eshard.com
Obfuscation of Rust code with LLVM
Option 1: Technical & Tutorial Focused (Best for SEO) Learn how to obfuscate Rust code using OLLVM. This guide walks you through rebuilding the Rust LLVM toolchain, building the obfuscator-llvm pass-plugin, and applying transformations like control flow flattening and bogus control flow.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Introducing constant-time support for LLVM to protect cryptographic code
Trail of Bits added constant-time support to LLVM, introducing the __builtin_ct_select intrinsics that stop compilers from optimizing cryptographic code into timing-attack-vulnerable branching.
blog · blog.trailofbits.com
Chaos Communication Congress (37C3) recap
Trail of Bits engineers recap 37C3 in Hamburg, covering their Pwndbg and Pwntools sessions and highlighting talks on fuzzing, side channels, reverse-engineering Rust, and proprietary cryptography.
Back