RESULTS.md (2398B)
1 # Spike 2: ppad-poly1305 on x86_64-linux 2 3 Target: ppad-poly1305 0.4.6 (173e478), GHC 9.10.3 with LLVM, as 4 released and with each of the elenchus vectors' mutant sets 5 (`mutants-1.patch`, `mutants-2.patch`). The harness MACs ten public 6 messages (empty, short final chunks, exact blocks) under fresh 7 secret keys and compares each tag with a public candidate. Sites 8 are named by the harness binary's symbols (no line tables). 9 10 ## Cost 11 12 About 1.6 seconds per memcheck trace (four keys) and 1.9 seconds 13 per three-run diff, on pollux. 14 15 ## Findings 16 17 - release: one memcheck site, the harness's branch on the result of 18 `(==)` (whether the tag matched: public by intent). Nothing in 19 the library; no differential origin in the harness binary. 20 - mutants-1: 21 - L3, the key-indexed nibble table in clamp: an address site in 22 `$wmac_slow`, x144 (four key bytes, nine non-empty messages, 23 four keys); also a differential address origin. 24 - L1, the variable-time compare in `reduce_full`: control sites 25 in `$wmac`. 26 - L2, the early-exit tag compare: one site where release has its 27 result branch. memcheck alone cannot tell the two apart; the 28 explain step must. The differential traces cannot see L2 at 29 all with random candidates, which mismatch at byte 0 every 30 time: it needs a designed input (a candidate sharing a prefix 31 with the true tag). 32 - D1 and D2, the decoys on the public message: not flagged. 33 - mutants-2: 34 - X2, the skip-multiply branch: control sites in `$wmac`. 35 - `(==)` without its barrier: stayed constant time, as on 36 aarch64 (the same result branch as release). 37 38 ## Lessons for GHC harnesses 39 40 - The runtime's default terabyte address-space reservation makes 41 memcheck crawl (ten seconds for a trivial program, apparent hangs 42 for real ones). `-with-rtsopts=-xr1G` fixes it. 43 - `-V0` (no interval timer) keeps the scheduler deterministic for 44 differential runs. 45 - Address-space randomisation made identical runs differ at 2183 46 places; `vestigia record` now turns it off for itself and QEMU. 47 - Even with layout fixed, a GHC program does not run identically 48 twice: about 120 instructions in libc and the runtime differ 49 between runs of the same key. A control run repeating the first 50 key exposes them, and `diff` sets them aside as unsteady; with 51 the control, mutants-1's origins are L3's address and L1's 52 branches, and none of the runtime's.