Post #3062335

2026-04-14 21:53 UTC

…and these “constant-time computation” patches, unlike for ARM and x86, do not offer any optimization for RISC-V for their fundamental primitive (ct.select), as RISC-V precisely eschewed that operation from its ISA; the patches instead fall back here to an expensive masking instruction sequence (in the one preexisting situation in RISC-V where branches are forbidden, the paper author describes the corresponding substitute instruction sequence as “grotesque”, cf page 36).

Replies (1)

@PierreLebeaupin@mastodon.gougere.fr 2026-04-14 21:53

Indeed, it was the intent for RISC-V code to use very short branches when other architectures would have used their conditional move/select instructions, but this obviously can’t be a solution for constant-time code sequences. Some ISAs are apparently considering “constant-time” variants of some their instructions to better support this use case, but can this be applied here?

Open ##3062336