essie-tls-rs VS ct-fuzz

This week I started writing a safe TLS library for it, called Essie TLS. I read a lot and found that constant-time Rust code requires unsafe. So my plan is to use a delay timer to avoid leaking secrets via timing side-channels. This will make TLS handshakes a little bit slower. Writing a TLS library is a lot of work. TLS 1.3 is very complicated and spans about 200 pages of RFCs. But the tools are working very nicely: Rust stable, CLion, and Gitlab.com.

Useful information I found on this topic: - Rust RFC 2533: Keeping Secrets in Rust - Variable-time multiplication attacked - subtle crate tries to proved constant-time data types - secrets crate zeros dropped secrets and prevents swapping secrets to disk. It uses the libsodium C library. - ct-fuzz can detect timing leaks in constant-time code. - Eliminating Timing Side-Channel Leaks using Program Repair, research paper, code not available - Timing Attacks and Countermeasures. Peter Schwabe. 2016.