Frank Denis 21ae64852a
std.crypto.kem.kyber: mitigate KyberSlash (#18316)
On some architectures, including AMD Zen CPUs, dividing a secret
by a constant denominator may not be a constant-time operation.

And most Kyber implementations, including ours, could leak the
hamming weight of the shared secret because of this. See:

https://kyberslash.cr.yp.to

Multiplications aren't guaranteed to be constant-time either, but
at least on the CPUs we currently support, it is.
2023-12-22 15:57:16 +00:00
..
2023-12-20 13:17:15 +02:00
2023-11-02 12:20:09 -07:00
2023-09-19 09:37:31 -07:00
2023-09-19 09:37:31 -07:00
2023-07-31 03:49:21 -04:00