Time measurements differ on microcontroller

Question

I am measuring the cycle count of different C functions which I try to make constant time in order to mitigate side channel attacks (crypto).

I am working with a microcontroller (aurix from infineon) which has an onboard cycle counter which gets incremented each clock tick and which I can read out.

Consider the following:

int result[32], cnt=0;
int secret[32];
/** some other code***/

reset_and_startCounter(); //resets cycles to 0 and starts the counter
int tmp = readCycles(); //read cycles before function call

function(secret) //I want to measure this function, should be constant time

result[cnt++] = readCycles() - tmp; //read out cycles and subtract to get correct result

When I measure the cycles like shown above, I will sometimes receive a different amount of cycles depending on the input given to the function. (~1-10 cycles difference, function itself takes about 3000 cycles).

I was now wondering if it not yet is perfectly constant time, and that the calculations depend on some input. I looked into the function and did the following:

void function(int* input){
    reset_and_startCounter(); 
    int tmp = readCycles(); 
   /*********************************
    ******calculations on input******
    *********************************/
    result[cnt++] = readCycles() - tmp;
}

and I received the same amount of cycles no matter what input is given.

I then also measured the time needed to call the function only, and to return from the function. Both measurements were the same no matter what input.

I was always using the gcc compiler flags -O3,-fomit-frame-pointer. -O3 because the runtime is critical and I need it to be fast. And also important, no other code has been running on the microcontroller (no OS etc.)

Does anyone have a possible explanation for this. I want to be secure, that my code is constant time, and those cycles are arbitrary...

And sorry for not providing a runnable code here, but I believe not many have an Aurix lying arround :O

Thank you

Answer 1

The Infineon Aurix microcontroller you're using is designed for hard real-time applications. It has intentionally been designed to provide consistent runtime performance -- it lacks most of the features that can lead to inconsistent performance on more sophisticated CPUs, like cache memory or branch prediction.

While showing that your code has constant runtime on this part is a start, it is still possible for your code to have variable runtime when run on other CPUs. It is also possible that a device containing this CPU may leak information through other channels, particularly through power analysis. If making your application resistant to sidechannel analysis is critical, you may want to consider using a part designed for cryptographic applications. (The Aurix is not such a part.)