Re: Running mpn_add_n at less than 1 cycle/limb

[Marco Bodrato]

Ciao Torbjörn,

Il giorno Domenica, Agosto 30, 2026 13:10 CEST, Torbjörn Granlund <tg at gmplib.org> ha scritto:
> Why is that? That mpn_add_n variant actually breaks the carry dependency
> chain by branching when carry-in of every 4th limb changes the
> carry-out.
> 
> Pretty cool, but unfortunately, this is not great for side-channel
> leakage.

Do you mean that we should add mpn_sec_add_n and mpn_sec_sub_n?

Then we can also accept the proposed "non constant-time" implementations for RISC-V :-)

Ĝis,
m