RSA is not "modern".
Modern elliptic curves are chosen with side channels in mind. You won't find data-dependent branches or look-ups in straightforward implementations of Curve25519 scalar multiplication, for example.
Modern elliptic curves are chosen with side channels in mind. You won't find data-dependent branches or look-ups in straightforward implementations of Curve25519 scalar multiplication, for example.
As it was pointed out already starting since Pentium 4, for example, the same assembly instruction "add dest, src" might take a different time depending on the value of dest and src.
Unless those modern elliptic curve compensate for specific models of CPUs they run on, their straight C and assembly code might behave as if it has data dependent branches.
I only saw evidence of data-dependent timing with respect to the div operation, but maybe I missed something.
Of course, I am not suggesting other operations are inherently immune to data-dependent timing leaks.
EDIT: I see there are also some notes on adc and sbb in some situations, i.e. chains of instructions that all light up the carry flag.
- Are in cache
- Were touched by a previous instruction (regardless of cache)
- Their cache line was touched by a previous instruction
- Will be read/write (immediately) after that instruction
- You're accessing data shared by multiple cores (lock prefix)
timing will vary