V8's Boolean Handling Broke My Constant-Time JavaScript Library
The V8 JavaScript Runtime Undermined My Constant-Time JavaScript Library
A Ph.D. student disclosed a side-channel in Soatok's constant-time-js library: V8's ToBoolean and signed-zero handling leak secret-dependent cache behavior through true/false Oddball objects. Soatok verified the report, released version 0.5.0 with a patch, and requested a CVE. The fix avoids booleans entirely and sidesteps negate-and-mask patterns, but true constant-time guarantees remain elusive in JavaScript.
Avoiding booleans is the only way to be safe.
- i2talics
I'm a security noob, but side channel attacks seem to me like something that you fundamentally just can't address by writing better software in a high-level language. The entire point is that they dig underneath all of your abstractions. It doesn't seem particularly tenable to keep playing whack-a-mole in this way.
- ErikCorry
Nobody was evil you just tried to rely on a property that V8 never promised.
Wasm doesn't promise it either but there's a much better chance you get what you want there.
- ndesaulniers
I was working on reimplementing the WebRTC stack in JavaScript a long time ago, never finished. The crypto folks at Mozilla (ekr@) suggested "maybe don't do that for dTLS."