RFC: branch-free modular primitives on the decrypt path (constant-time hardening)

bader · April 24, 2026, 11:00pm

Hi all,

I've prepared a constant-time hardening of the modular primitives. Data-dependent branches are replaced with bitmask-select plus a compiler barrier that survives `-O0..-Ofast` on GCC and Clang.


## Branch

https://github.com/BAder82t/openfhe-development/tree/fix/ct-mod-mul-fast-const


This RFC closes the orthogonal timing-side channel by removing data-dependent branches from the same code region.

Methodology follows the PermNet-RM constant-time Reed-Muller encoder (https://github.com/BAder82t/PermNet-RM): explicit bitmask + inline-asm opacifier so aggressive optimization can't reconstruct the branch via value-range propagation.

Thanks

ypolyakov · April 29, 2026, 6:53pm

Hi @bader Thank you for posting this. I’ve added your github account to the openfhe-development repository. Please create a branch there from dev and submit a PR so we could review it (and run CI against it).

bader · April 29, 2026, 8:14pm

Thanks @ypolyakov, all done.

github.com/openfheorg/openfhe-development

security: branch-free modular primitives on decrypt hot path (#1177)

main ← security/ct-mod-decrypt

opened 08:12PM - 29 Apr 26 UTC

BAder82t

+1816 -1816

## Summary This PR removes data-dependent branches from modular arithmetic us…ed during `Decrypt`. Branches whose direction depends on secret values can leak information through timing, so this change replaces them with branchless bitmask-based equivalents. The new helpers also include a small inline-asm barrier for GCC and Clang to make it harder for the optimizer to rewrite the branchless form back into conditional branches at higher optimization levels. ## What changes ### New header — `src/core/include/utils/constanttime.h` Adds four small inline helpers in namespace `lbcrypto::ct`. Each helper implements the same operation as the original conditional logic, but uses a mask derived from the sign bit or borrow bit instead of a branch. | Helper | Replaces | |---|---| | `AddIfNeg(x, m)` | `x < 0 ? x + m : x` | | `SubIfGE(x, m)` | `x >= m ? x - m : x` | | `ModSubFast(a, b, m)` | `a - b mod m` | | `SubIfAboveHalf(x, m, halfQ)` | centered-lift correction when `x > halfQ` | ### Call sites — `src/core/include/math/hal/intnat/ubintnat.h` The existing public functions are preserved; only their internals change. - `ModAddFast` / `ModAddFastEq` now call `ct::SubIfGE` - `ModSubFast` / `ModSubFastEq` now call `ct::ModSubFast` - `ModMulFastConst` / `ModMulFastConstEq` now call `ct::AddIfNeg` ### NTT butterflies — `src/core/include/math/hal/intnat/transformnat-impl.h` The NTT butterflies previously had separate GCC and non-GCC implementations, each with its own conditional fixups such as: ```cpp if (hiVal >= modulus) hiVal -= modulus; if (loVal < omegaFactor) loVal += modulus;

Topic		Replies	Views
Optimizing HEXL parameters OpenFHE Hardware Acceleration	2	34	January 25, 2026
Implementation details of ModMulFastConst function Library Questions	1	46	May 12, 2025
Library feature request: Setting moduli chain directly Library Questions	3	62	September 30, 2025
Decompose operation of ckks-hybrid-KS FHE Questions	1	355	July 24, 2023
Change Ciphertext Modulus BGV Library Questions	2	38	May 30, 2025

RFC: branch-free modular primitives on the decrypt path (constant-time hardening)

Related topics