Reports › hash-35 · Constant-time review
Wish (hash-35)
| Candidate | Wish |
|---|---|
| Family | Symmetric (AES-derived sponge hash) |
| Archive | Wish.zip (SHA-256: f878ea89f5b5929c26445a4b1967f21139c74600d5779e4eb5d0bd7f97bea4b5) |
hash-35-1: Secret-indexed S-box and variable-time field multiplication
| Severity | Medium |
|---|---|
| Scope | side-channel |
| Status | Confirmed |
| Affected | Reference Wish512 and Wish1024 |
| Discovery | Trivial |
| Exploitation | Cache or branch side-channel dependent |
| Credit | Markku-Juhani O. Saarinen markku-juhani.saarinen@tuni.fi, with AI assistance |
| Date | 2026-09-23 |
Every permutation round reads S_Box[s[i]] with an evolving secret state byte (wish.c:98). Its 256-byte table spans cache lines. GF_Mul also loops until a secret-dependent multiplier becomes zero and branches on each multiplier bit (:86-91). This gives both memory-address and control-flow leakage; no full preimage recovery is claimed. See constant_time.md.
Reproducing
Commands below run in a checkout of the ngcc-harness repository with the candidate built (see its README).
Inspect wish.c:86-99 in either reference variant. With multiplier b=1, GF_Mul executes one iteration; with b=128, it executes eight.