Hi there, I’m one of the leads of RustCrypto.
I used to propose an attribute-based solution in [RFC] Constant Time Execution Guarantees in LLVM . It is intended to reuse the existing codebase and maintain a good performance. However, after a deep investigation on OpenSSL and BoringSSL, I found that the patterns are significantly different from other applications. Therefore, adding a set of primitives and writing specific optimizations for crypto applications seems feasible.
We are still in a position where we would prefer to replace code using new intrinsics to get constant-time guarantees, as opposed to incremental hardening. If I understand how your proposal was supposed to work, it sounds like it might make it difficult to mix constant-time and non-constant-time operations, e.g. only performing constant-time operations on values containing secrets, and using non-constant-time operations on non-secret values for performance.
In the past some of us had worked with Chandler Carruth to come up with a proposal to add “secret integer types” to Rust which would ideally lower to LLVM types which would ensure only the instructions on your list are executed on them, avoiding ever branching on them or using them in pointer calculations:
I believe there was some internal work in Google to implement this for Rust+LLVM+RISC-V but I’m not sure that ever saw the light of day.
Using types for this purpose prevents confusion around “forgetting to use the constant time version of a function”. Ideally it should be impossible to misuse such types, aside from converting them to non-secret integer types and then performing non-constant-time operations on them.
Regarding the OP, we’ve worked around x86-cmov-conversion using inline assembly (emitting cmov family on x86, csel on ARM, with a “best effort” portable fallback with no guarantees):
I think it would be great to have first-class support for something like this in LLVM. It has become commonplace for new cryptographic specifications to use a pseudocode “CMOV”-like function to describe where to apply this sort of predication.