Part 1: The life of an optimization barrier

Summary: Trail of Bits tested how compiling constant-time Rust cryptographic code to WebAssembly with wasm-pack and running it in node affects timing-attack protections, since the code is optimized twice - first by LLVM, then by node's Turbofan JIT compiler. The firm found that LLVM must write the input value to Wasm memory to create the reference that core::ptr::read_volatile requires, and because that memory is exported by the Wasm module, the secret value passed into black_box can be read from JavaScript before and after the call.
What you should know: Every value routed through black_box is sensitive by definition, so a library packaged this way can leak its secrets to any JavaScript running alongside it - and the compiler has no concept of time, meaning it remains free to rewrite constant-time code until language and compiler support for secret types exists.

Read the original at Trail of Bits Blog ↗