Cryptography for ARM NEON

Recent research has shown that implementations with variable execution timing may allow attackers to extract secret cryptographic keys stored on the device. Timing variances can occur due to implementation choices (e.g. data-dependent branches) or due to the internal architecture of the processor core (e.g. cache lines). In order to overcome this problem one needs to find alternative implementation strategies that are naturally immune to timing attacks. A possibility is to use bitslicing techniques that ensure independent data flows and avoid the use of look-up tables.