Frank Denis 21ae64852a
std.crypto.kem.kyber: mitigate KyberSlash (#18316)
On some architectures, including AMD Zen CPUs, dividing a secret
by a constant denominator may not be a constant-time operation.

And most Kyber implementations, including ours, could leak the
hamming weight of the shared secret because of this. See:

https://kyberslash.cr.yp.to

Multiplications aren't guaranteed to be constant-time either, but
at least on the CPUs we currently support, it is.
2023-12-22 15:57:16 +00:00
..
2023-11-03 23:18:21 -04:00
2023-11-19 09:55:07 +00:00
2023-11-03 23:18:21 -04:00
2023-04-30 18:16:04 -07:00
2023-11-22 11:32:14 -07:00
2023-11-03 23:18:21 -04:00
2023-11-03 23:18:21 -04:00
2023-10-02 15:31:49 -06:00