Post #3062334

2026-04-14 21:53 UTC

However, what has occurred in the last 10 years is that not only computation latency side channel leaks needed to be plugged, but that this couldn’t reasonably be done by second-guessing the compiler and processor: “constant-time computation” patches have recently been written to ensure, when needed, the compiler emits straightline code, so that whether any instruction is executed or not does not depend on the input data, and all are constant time https://github.com/llvm/llvm-project/pull/166702

Replies (1)

@PierreLebeaupin@mastodon.gougere.fr 2026-04-14 21:53

…and these “constant-time computation” patches, unlike for ARM and x86, do not offer any optimization for RISC-V for their fundamental primitive (ct.select), as RISC-V precisely eschewed that operation from its ISA; the patches instead fall back here to an expensive masking instruction sequence (in the one preexisting situation in RISC-V where branches are forbidden, the paper author describes the corresponding substitute instruction sequence as “grotesque”, cf page 36).

Open ##3062335